CVE-2017-14335

published 2017-09-12

CVE-2017-14335: On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows…

Priority P2 65 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I H A N

EXPLOIT

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Detection & IOCs extracted from sources · hover to see the quote

url PUT /ISAPI/Security/users/1 HTTP/1.1↗

path /ISAPI/Security/users/1↗

command 1adminadmin10.0.0.0::administratortrue↗

• → Detect unauthenticated or unauthorized HTTP PUT requests targeting the /ISAPI/Security/users/1 endpoint on Hanbanggaoke IP camera devices, which indicates an attempted admin password change exploit. ↗
• → Look for the Base64 credential string 'YWRtaW46ODg4ODg4' (decodes to admin:888888) in Authorization headers or cookies (userInfo80), as this is the default credential used in exploitation of this CVE. ↗
• → Monitor for HTTP PUT requests to /ISAPI/Security/users/1 with a Content-Type of application/x-www-form-urlencoded and a body containing XML-like admin user data, which is the payload structure used in this attack. ↗
• → Flag HTTP PUT requests to /ISAPI/Security/users/1 originating with a Referer header pointing to /doc/page/paramconfig.asp, as this is the page from which the exploit is launched. ↗

• · There is no vendor patch or workaround available for this vulnerability; the vendor (Hanbanggaoke/Beijing Hanbang Technology) did not respond to disclosure attempts. ↗
• · The exploit requires only a valid (possibly default) admin session/cookie to perform the password change, meaning devices with default credentials (admin:888888) are trivially exploitable without prior compromise. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20