Annke Network Video Recorder
Act Now9.4ICS-CERT ICSA-21-238-02Aug 26, 2021
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A stack-based buffer overflow in Annke Network Video Recorder V3.4.106 (build 200422 and earlier) allows an unauthenticated remote attacker to execute arbitrary code and access sensitive information. The vulnerability can be triggered via a specially crafted network request without requiring valid credentials. Successful exploitation could grant an attacker control of the recorder, access to stored video and recordings, and potential network access for further lateral movement.
What this means
What could happen
A stack-based buffer overflow in the Annke Network Video Recorder could allow an attacker to execute arbitrary code on the device, potentially gaining access to video feeds, recordings, and network credentials stored on the recorder, or using it as a pivot point into your network.
Who's at risk
Organizations running Annke Network Video Recorders (V3.4.106 build 200422 or earlier) in surveillance systems supporting critical infrastructure monitoring, including water utilities, electric utilities, and municipal facilities. This is particularly relevant if the recorder is accessible from the Internet or unsecured network segments.
How it could be exploited
An attacker sends a specially crafted network request to the vulnerable Annke recorder without needing credentials. The request triggers a buffer overflow that overwrites memory on the device, allowing the attacker to inject and run malicious code with the privileges of the recorder process.
Prerequisites
- Network reachability to the Annke recorder over its management/HTTP port
- No authentication required
- Vulnerable firmware version (V3.4.106 build 200422 or earlier)
remotely exploitableno authentication requiredlow complexitystack-based buffer overflowno patch available for affected version
Exploitability
Moderate exploit probability (EPSS 1.6%)
Affected products (1)
ProductAffected VersionsFix Status
V3.4.106: build 200422 and prior≤ 200422No fix yet
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict network access to the Annke recorder: place it behind a firewall and disable any Internet-facing access (close ports to WAN, restrict to management VLAN only)
WORKAROUNDIf remote access to the recorder is necessary, require VPN connection rather than direct Internet access
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Annke Network Video Recorder to the latest available firmware version
Long-term hardening
0/1HARDENINGIsolate the camera network segment from your main business network to limit lateral movement if the recorder is compromised
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d24eddd1-d612-48c3-a639-7c3dc06605e0