| Amcrest UltraHD 4MP PoE Camera (IP8M-2496EB)
|
|
Security Grade
Calculator vv1
|
Amcrest UltraHD 4MP PoE Camera
Release Date: 2019-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Very common
|
🔗 Proof
|
The published analysis of CVE-2017-8229 shows the researcher reaching the file system over Telnet and reading configuration from /mnt/mtd/Config, so a debug or maintenance interface is reachable on the device.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Eleven CVEs are recorded against the brand, including CVE-2017-8229 (CVSS 9.8, unauthenticated download of administrator credentials), CVE-2020-5735 (CVSS 8.8, stack buffer overflow on port 37777), CVE-2018-16546 (hard coded SSL private key shared across customer installations) and CVE-2019-3948 (unauthenticated access to the /videotalk audio endpoint). The firmware derives from Dahua, whose protocol stack has a recurring memory safety record.
|
| Prior attacks
|
Very common
|
🔗 Proof
|
CVE-2020-5735 was added to the CISA Known Exploited Vulnerabilities catalogue on 3 November 2021 with a remediation deadline of 3 May 2022, and EPSS rates it around 36 percent at the 98th percentile, which is clear evidence of exploitation in the wild.
|
| Updatability
|
Very common
|
🔗 Proof
|
Amcrest publishes firmware with explicit fixed version numbers for the reported issues and delivers updates through the support portal and the app.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
CVE-2019-3948 allows an unauthenticated person to reach the /videotalk endpoint and listen to device audio, while CVE-2020-7222 bypasses the web login by changing the JavaScript result parameter to true.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
CVE-2018-16546 documents the same hard coded SSL private key across different customers installations, which defeats the cryptographic protection of the management connection.
|
| Storage
|
No encryption
|
🔗 Proof
|
Account files including SHA1Account1 are stored under /mnt/mtd/Config and can be downloaded over HTTP without authentication, so credentials at rest are exposed rather than encrypted.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Users are divided into admin and user groups only, and CVE-2017-8230 documents additional authorization weaknesses around those groups.
|
| Authentication
|
Basic
|
🔗 Proof
|
A login exists but is bypassable by altering the client side result value, and several endpoints answer without any authentication.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
Since administrator credentials can be downloaded unauthenticated, throttling or lockout provides no protection.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Recording and access history exist, but no complete security audit log is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
A password is defined during initial configuration, but default account material remains retrievable from the device.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux (Companion App: Amcrest View Pro (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD up to 256 GB
|
| Power, Battery & Charging
|
Battery: None • Power: Power over Ethernet (IEEE 802.3af) or 12 V DC • Charging:
|
| Display & Camera
|
Display: • Camera: 4 MP (2560 x 1440), varifocal lens, infrared night vision
|
| Sound & Connectivity
|
Sound: Microphone and speaker • Connectivity: Ethernet 10/100 Mbps with PoE
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 160 x 100 x 100 mm • Mass: approx. 500 g
|
Overall assessment: This is the weakest device in the batch and the only one with confirmed exploitation in the wild. CVE-2020-5735 (CVSS 8.8, stack buffer overflow on port 37777) was added to the CISA Known Exploited Vulnerabilities catalogue on 3 November 2021 and carries an EPSS around 36 percent at the 98th percentile. Eleven CVEs are recorded against the brand, including CVE-2017-8229 (CVSS 9.8) where administrator credentials can be downloaded without any authentication from /mnt/mtd/Config, CVE-2018-16546 where the same hard coded SSL private key is shared across customer installations, which defeats transport encryption, and CVE-2019-3948 where an unauthenticated person can reach the /videotalk endpoint and listen to device audio. Login can be bypassed by altering the client side result value, so brute-force protection is meaningless when credentials are simply downloadable. Amcrest does publish firmware with explicit fixed versions, but that is the only substantial mitigating factor for a device whose firmware derives from the Dahua stack with a recurring memory safety record.
