CVE-2024-13893

Executive Summary

CVE-2024-13893 exposes a critical security flaw in Smartwares IP cameras (models CIP-37210AT, C724IP, and potentially others sharing the same firmware up to version 3.3.0). The vulnerability stems from the use of hard-coded credentials for the Telnet service, which is disabled by default but can be activated by inserting an SD card with a specifically named folder. An attacker with physical access to the device can retrieve the password hash from SPI-connected memory, enabling persistent, privileged remote access via Telnet. The vendor has not responded to disclosure attempts, leaving the patching status unknown and potentially affecting newer firmware versions.

Supply Chain & Package Security

This vulnerability is not related to any software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a hardware/firmware-level issue in embedded IoT devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) → Re-calculated: 6.8 (Medium)
• Attack Vector (AV): Physical (AV:P) – Requires physical access to retrieve the hash.
• Attack Complexity (AC): Low (AC:L) – No special tools beyond SPI programmer.
• Privileges Required (PR): None (PR:N)
• User Interaction (UI): None (UI:N)
• Scope (S): Unchanged (S:U)
• Confidentiality (C): High (C:H) – Full device access.
• Integrity (I): High (I:H) – Can modify firmware/config.
• Availability (A): High (A:H) – Can disable device.
• Threat Level: Medium (due to physical access requirement, but high impact once exploited).

Deep Dive & Mechanics

The vulnerability is rooted in the firmware’s Telnet service implementation. The password hash is stored in a fixed location on the SPI flash memory. By physically connecting to the SPI interface (e.g., using a Bus Pirate or SOIC clip), an attacker can dump the flash contents and extract the hash. The hash is identical across all devices sharing the same firmware version (up to 3.3.0), meaning one extracted hash works for all vulnerable units.

The Telnet service is disabled by default. To enable it, the attacker must insert an SD card containing a folder with a specific name (e.g., telnet_enable or similar). This design suggests the feature was intended for debugging but left insecure.

Attack Flow:

1. Gain physical access to the camera.
2. Connect to SPI flash (e.g., via test points or chip clips).
3. Dump firmware and extract password hash.
4. Crack the hash (likely MD5 or SHA-1) offline.
5. Insert SD card with the magic folder name.
6. Telnet into the device using the cracked password.
7. Full root access to the camera.

Vulnerable vs. Patched Code

Since no patch exists, we compare the vulnerable firmware behavior to a hypothetical secure implementation.

Vulnerable (firmware <= 3.3.0):

// Pseudocode for Telnet credential check
#define TELNET_PASSWORD_HASH "5d41402abc4b2a76b9719d911017c592" // Example MD5 of "hello"
int check_telnet_password(char *input) {
    char hash[33];
    md5(input, hash);
    return strcmp(hash, TELNET_PASSWORD_HASH) == 0;
}

Patched (hypothetical):

// Secure implementation: unique per-device password, stored encrypted
int check_telnet_password(char *input) {
    char stored_hash[33];
    read_device_unique_key(stored_hash); // From secure element or OTP
    char input_hash[33];
    sha256(input, input_hash);
    return secure_memcmp(input_hash, stored_hash, 32) == 0;
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Smartwares camera (CIP-37210AT or C724IP)
• SPI programmer (e.g., Bus Pirate, CH341A)
• SOIC clip or soldering iron
• SD card (FAT32 formatted)
• Computer with flashrom and hashcat

Steps:

1. Dump SPI Flash:

   # Identify SPI pins (usually near main chip)
   flashrom -p ch341a_spi -r firmware_dump.bin
   

2. Extract Password Hash:

   # Search for hash pattern (32 hex chars)
   strings firmware_dump.bin | grep -E '^[a-f0-9]{32}$'
   

3. Crack Hash:

   hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
   

4. Enable Telnet:
   • Create folder named telnet_enable (or similar) on SD card.
   • Insert SD card into camera and reboot.
5. Connect:

   telnet <camera_ip>
   # Login: root / <cracked_password>
   

Blue Team (Defensive)

Detection:

• Monitor for physical tampering (case opening, SPI probing).
• Network scan for unexpected Telnet (port 23) traffic from cameras.
• Check SD card slot for unauthorized cards.

Mitigation:

• Disable SD card slot if not needed.
• Use network segmentation to isolate cameras.
• Implement 802.1X for device authentication.

Indicators of Compromise (IOCs)

• Network: Telnet sessions (port 23) from camera IPs.
• File System: Presence of folder telnet_enable on SD card.
• Hardware: SPI flash dump attempts (unusual voltage/clock activity on SPI lines).
• Firmware: Modified firmware with backdoored credentials.

Detection Engineering

YARA Rule

rule Smartwares_Hardcoded_Telnet_Creds {
    meta:
        description = "Detects hardcoded Telnet password hash in Smartwares camera firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13893"
    strings:
        $hash = /[a-f0-9]{32}/  // MD5 hash pattern
        $telnet_str = "telnet" nocase
    condition:
        $telnet_str and #hash >= 1
}

Sigma Rule

title: Smartwares Camera Telnet Service Activation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Telnet connections from Smartwares cameras
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 23
        Image|endswith: 'telnet.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"Smartwares Camera Telnet Outbound"; flow:to_server; content:"|0d 0a|"; depth:2; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SD card slot if not required for operation.
2. Segment IoT devices on a separate VLAN with strict firewall rules.
3. Monitor for Telnet traffic (port 23) from camera IPs.
4. Replace devices with patched alternatives if available.

Long-term:

• Vendor engagement: Pressure Smartwares via regulatory bodies (e.g., CISA, ENISA).
• Firmware signing: Implement secure boot and signed firmware updates.
• Unique credentials: Use per-device keys stored in secure element.

No patch available – assume all devices are vulnerable.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert