Twenty Year Anniversary

Faleemi FSC-880 CSRF / SQL Injection / Command Execution

Faleemi FSC-880 CSRF / SQL Injection / Command Execution
Posted Sep 29, 2017
Authored by Oleg Puzanov

Faleemi FSC-880 suffers from command execution, cross site request forgery, remote SQL injection, and various other vulnerabilities.

tags | exploit, remote, vulnerability, sql injection, csrf
advisories | CVE-2017-14743
MD5 | 3621d070c03120bb5f7f1fb0e4811228

Faleemi FSC-880 CSRF / SQL Injection / Command Execution

Change Mirror Download
Full disclosure is here: <>



25 August 2017: the research was made
29 August 2017: an email was sent to the vendor, but with no answer
25 September 2017: public disclosure
26 September 2017: assigned CVE-2017a14743

Firmware: (2017-07-27)

This camera has multiple security vulnerabilities, which can be exploited both locally and remotely. In particular, hardwired manufacturer DDNS and port-mapping to camera via upnp compatible router. Allowing for the discovered avoidance of authentication and RCE, this camera is an ideal candidate for another botnet such as Mirai.




Works in stock firmware (E2017a03-**)

In the latest firmware ( (2017a07a27)) this is fixedaaaftp client is removed. It is not in processes and in file systemaaaostensibly because realization was altered.

Remote code execution in admin panel in GET parameters of Ft server scenario



During analysis and reversing of the firmware we found and undocumented functionaaait is possible to quite simply turn on telnet on the device:

Turn on telnet on port 23

Check status

Password protected Telnetaaasame as on web panel but with one exception: telnet is not connected to upnp. This suggests that port is not accessible outside LAN.

We have so far been unable to connect it because we have not found custom settings of doing so to upnp.

enable upnp:

upnp status:
Plaintext passwords

User passwords are stored on the device in plaintext format in several locations simultaneously:


Passwords are synchronised when changed.
Information Disclosure

Prior (2017a07a27)aaa0DAY

Device Info:

WIFI credentials leak:

Current user credentials leak:

All users credentials leak:

Third Party DDNS credentials leak:

Manufactureras DDNS credentials leak:

SMTP settings and credentials leak:

FTP settings and credentials leak:


Prior (2017a07a27)aaa0DAY

All changes in camera settings go through GET commands and donat use CSRF tokens.

The following functions can be executed remotely:

Configure Camera
Format SD card
Delete Logs
Steal image from camera

These actions and commands can be executed from admin browser. The indecent hacker only needs to lure the admin to their page.

Similar attacks on routers have been registered in the past:

And some more epic stuff
Manufactureras DDNS enumeration

There are hardwired DDNS manufacturer settings found in the device. The device sends an http request using udp, and sends its internal address and admin web panel IP address to API

The device we researched has DDNS name Knowing that device names are generated automatically, it is possible to enumerate the entire range of names using a mask 00\d[a-z]{4} and obtain a full list of devices in the network.

We found a total of 758000 devices, which connected with this DDNS at least once in the past.

These are cameras by different manufacturers, that are somehow related to each other.

Around 3% of devices are in the network..
HK 18.41%
US 12.72%
DE 9.94%
ES 6.77%
FR 5.66%
AR 5.09%
GB 5.00%
DK 3.79%
IT 3.34%
PL 3.04%
MX 1.90%
CN 1.55%
VN 1.53%
JP 1.53%
HU 1.40%
CL 1.27%
BR 1.20%
TH 1.19%

A little over 20% of all devices use a default password. Virtually all devices are accessible by ONVIF

A similar number (20a25 thousands devices are online) are vulnerable to auth bypass via sqli.

We have serious concerns that the DDNs password, which is hardwired into the device by the manufacturer is incremental. This means that it is possible to reverse-calculate the password to the camera based on its DDNS name.

This raises the risk of the password being hijacked if the IP cards are switched on DDNS server, then redirected the admin using a camera with a DDNS name and grabs the password using his own authentication form.

Authorization bypass via blind SQLi

Prior (2017a07a27)aaa0DAY

A device without authentication on web-port has an accessible endpoint by default /onvif/

ONVIF is an API standard for such devices. WSDL can be downloaded from the official website (

API uses authentication by tokens.

This device also has an SQL injection vulnerability in the username field of the authentication token. Using this it is possible to obtain an admin password.

Example of the exploit:

/* */

POST /onvif/device_service HTTP/1.1
Content-Type: application/soap+xml
Content-Length: 1076
charset: utf-8
Connection: close

<s:Envelope xmlns:s="" xmlns:a="">
<Security s:mustUnderstand="1" xmlns="">
<Username>adfgadfhart' AND 1=2 UNION SELECT 1,'admin',(select unicode(substr(C_PassWord, 2, 1)) from t_user limit 1 OFF
SET 0),'remark'/*</Username>
<Password Type="">UHZj
<Nonce EncodingType="">fD
<Created xmlns="">1970-01-01T00:03:58
<s:Body xmlns:xsi="" xmlns:xsd="">
<GetDeviceInformation xmlns=""/>

To do this, the date and time set in the device are needed because they are used to build the password field of the authentication token.

We drafted this POC, which allows to extract from the camera a password and gain entry to the device using admin credentials.

This research was made by IoTSploit Team. Feel free to contact us at and visit our website at

If you have any active contact with Faleemi, please, show them this report and we are ready to coop.


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    3 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    18 Files
  • 6
    Sep 6th
    18 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    2 Files
  • 9
    Sep 9th
    2 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    17 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    29 Files
  • 14
    Sep 14th
    21 Files
  • 15
    Sep 15th
    3 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    16 Files
  • 19
    Sep 19th
    29 Files
  • 20
    Sep 20th
    18 Files
  • 21
    Sep 21st
    5 Files
  • 22
    Sep 22nd
    2 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By