CareCam Pro IP Cameras
A critical vulnerability exists in CareCam Pro and CareCam IP cameras due to a hard-coded credential in the bootloader. Physical access to the device allows an attacker to gain privileged bootloader access, enabling firmware modification and complete device compromise. CISA advises users to minimize network exposure and implement robust security measures.
A critical vulnerability has been identified in CareCam Pro and CareCam IP cameras. The issue stems from a hard-coded credential within the bootloader, allowing attackers with physical access to the device to gain privileged bootloader access. This access enables them to modify firmware and system configuration, potentially leading to complete device compromise. The vulnerability affects devices deployed worldwide, with CareCam's headquarters located in China. CISA has not yet received a response from CareCam regarding remediation efforts. The vulnerability is classified as CWE-798 – Use of Hard-coded Credentials. CISA recommends minimizing network exposure for control system devices, isolating them from business networks, and utilizing secure remote access methods like VPNs, recognizing that VPNs themselves can have vulnerabilities. Organizations are encouraged to perform impact analysis and risk assessments and to proactively implement cybersecurity strategies for industrial control systems assets. CISA also advises users to avoid clicking links or opening attachments in unsolicited emails and to report any suspected malicious activity.