09/04/2024
On Wednesday, security researchers at Akamai Technologies warned that the Mirai Corona botnet is exploiting a previously unknown flaw to mass infect internet-connected cameras.
The zero-day vulnerability affects the AVM1203 camera from Taiwanese vendor Avtech Security. Akamai researchers discovered that the brightness function in the camera can be abused to remotely inject and execute commands into the camera's software with elevated privileges.
Despite the fact that the cameras are quite old, the CISA stated in their advisory that these devices are still used worldwide, including by transportation authorities and other critical infrastructure entities.
The flaw opened the door for the Mirai Corona botnet—a malicious army of infected routers—to spread and take over AVM1203 cameras connected to the internet. According to Akamai’s report, the botnet has been leveraging the vulnerability since at least December 2023.
Interestingly, a proof-of-concept exploiting the flaw in the camera has been around since 2019, but it never received a vulnerability designation until this month. Avtech Security did not immediately respond to a request for comment.
🔗: https://www.pcmag.com/news/botnet-takes-over-security-cameras-using-a-flaw-that-wont-be-patched
