CVE-2020-23826 - RCE vulnerability in Yale WIPC-303W IP camera

 

I have recently reported a vulnerability in Yale IP camera WIPC-303W. 

Yale is is one of the world's oldest lock manufacturers, owned by Assa Abloy (from Wikipedia) , and apparently they also started manufacturing cameras and other IoT products for home security a few years ago.

VULNERABILITY DETAILS

This vulnerability allows attackers who have managed to authenticate successfully with the web interface of the camera's management system, to send a specially crafted packet which will result in the attacker's ability to run arbitrary commands on the camera itself remotely. 

This is possible due to a lack of input validation in one of APIs the web CGI exposes to the user, resulting in a command injection vulnerability.

 

Affected versions tested: WIPC-303W 2.21 - 2.31