Vulnerability Description

The Hipcam device is vulnerable to unauthorized access, allowing an attacker to retrieve the MAC address of the device without proper authentication or authorization. By sending a specific HTTP request to the device, an attacker can obtain sensitive information about the device, which could be used for further exploitation or unauthorized access.

Vulnerability Impact

This vulnerability poses a moderate risk to the security of the Hipcam device and its users. Although the MAC address alone may not directly compromise the device or its network, it can be used as part of a reconnaissance phase in a larger attack. Furthermore, unauthorized access to device information undermines the confidentiality and integrity of the device's data, affecting over 722,000 devices on the Internet.

Affected Components

• Hipcam Device

Vulnerability CWE

CWE-200: Information Exposure

Exploitation

Launch an HTTP GET request to the target device:

curl http://<DEVICE_IP_ADDR>/log/wifi.mac

Upon successful exploitation, the response will contain the MAC address of the device without requiring any form of authentication or authorization.

Actual Result

Sample 1

Sample 2

Sample 3