SID 1:45314

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Beijing Hanbang Hanbanggaoke IP camera admin password change attempt

Rule Explanation

This event is generated when an attempt to change the admin password of a vulnerable Hanbanggaoke IP camera is detected. Impact: Medium Details: The Hanbanggaoke devices are IP cameras manufactured by the chinese company Beijing Hanbang. These devices are vulnerable due that an input controlled by the user is not sufficiently sanitized and by sending a PUT request to the vulnerable URI, an attacker can change the admin password to anything he wants and have complete administrator access to the device. Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group