"InfiRay Thermal Camera Flaws Can Allow Hackers to Tamper With Industrial Processes"
Security researchers at SEC Consult have discovered that InfiRay thermal cameras are affected by vulnerabilities that could allow malicious hackers to tamper with industrial processes. InfiRay is a brand of China-based iRay Technology that manufactures optical components. InfiRay specializes in the development and manufacturing of infrared and thermal imaging solutions, with its products being sold in 89 countries and regions. The security researchers discovered that at least one of the vendor’s thermal cameras, the A8Z3 model, is affected by several potentially serious vulnerabilities. According to the researchers, the product is affected by five types of potentially critical vulnerabilities. One issue is related to hardcoded credentials for the camera’s web application. Since these accounts cannot be deactivated and their passwords cannot be changed, they can be considered backdoor accounts that can provide an attacker access to the camera’s web interface. From there, an attacker can leverage another vulnerability for arbitrary code execution. The researchers also found a buffer overflow in the firmware and multiple outdated software components that are known to contain vulnerabilities. They also found a Telnet root shell that, by default, is not protected by a password, giving an attacker on the local network the ability to execute arbitrary commands as root on the camera. The A8Z3 is used in industrial environments to check/control temperatures. The researchers stated that an attacker would be able to report wrong temperatures and thus create inferior products or halt the production. SEC Consult reported its findings to the vendor more than a year ago, but the company has been unresponsive, so it’s unclear if patches are available.