cbcvebase.
CVE-2017-7462
published 2017-04-11

CVE-2017-7462: Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.

PriorityP269critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
12.75%
95.8th percentile
Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.

Affected

1 ranges
VendorProductVersion rangeFixed in
intellinet-networknfc-30ir_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/mft/manufacture↗
url/cgi-bin/admin/fileread?READ.filePath=/etc/passwd↗
othermanufacture:erutcafunam↗
otherAuthorization: Basic YWRtaW46YWRtaW4=↗
path/opt/cgi/↗
  • →Detect HTTP requests to the backdoor CGI endpoint /cgi-bin/mft/manufacture, especially with Authorization header containing credentials for 'manufacture' user. ↗
  • →Detect HTTP GET requests to /cgi-bin/admin/fileread with a READ.filePath parameter traversing to sensitive files such as /etc/passwd or /etc/boa.conf, indicating LFI exploitation (CVE-2017-7461). ↗
  • →Flag use of the hardcoded Base64 Authorization header 'YWRtaW46YWRtaW4=' (admin:admin) against Intellinet NFC-30IR camera web interfaces. ↗
  • →The boa.conf directive 'MFT manufacture erutcafunam' is the configuration artifact enabling the backdoor; presence of this string in device config indicates a vulnerable/backdoored device. ↗
  • ·Vulnerability affects firmware version LM.1.6.16.05 specifically; detections should be scoped to this firmware version where identifiable. ↗
  • ·The NFC-30IR does NOT contain the wireless_mft executable, distinguishing it from other Zavio-based camera variants that may share the same manufacture backdoor binary. ↗
  • ·The manufacture CGI binary is believed to be shared with other camera vendors using the same Zavio board; the backdoor credentials and endpoint may apply beyond just Intellinet NFC-30IR. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.