D-Link Securicam Network DCS-900 Internet Camera Remote Configuration Vulnerability

Bugtraq ID:	11072
Class:	Design Error
CVE:	CVE-2004-1650
Remote:	Yes
Local:	No
Published:	Aug 31 2004 12:00AM
Updated:	Jul 12 2009 06:17AM
Credit:	The individual responsible for discovery of this issue is currently unknown.
Vulnerable:	D-Link DCS-900 Internet Camera 2.28 D-Link DCS-900 Internet Camera 2.20 D-Link DCS-900 Internet Camera 2.10
Not Vulnerable:

D-Link Securicam Network DCS-900 Internet Camera Remote Configuration Vulnerability

D-Link Securicam Network DCS-900 Internet Camera is reportedly affected by a remote configuration vulnerability. This issue is due to a design error that allow remote, unauthorized users to update the IP address of the vulnerable camera.

An attacker may leverage this issue to hijack the vulnerable camera, ultimately triggering a denial of service condition, as the unsuspecting user will be unable to connect to the device without having its IP address.

D-Link Securicam Network DCS-900 Internet Camera Remote Configuration Vulnerability

The following exploit has been provided:

• /data/vulnerabilities/exploits/dLinkNetCamIPAddressSetExploit.c

D-Link Securicam Network DCS-900 Internet Camera Remote Configuration Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

D-Link Securicam Network DCS-900 Internet Camera Remote Configuration Vulnerability

References:

• DCS-900 Internet Camera Home Page (D-Link)
  
• D-Link DCS-900 IP camera remote exploit that change the IP ("Jérôme" ATHIAS )