Skip to Content

Hundreds of brands of security cameras, baby monitors, and “smart” doorbells have serious vulnerabilities that allow hackers to hijack devices and spy on their owners.

Affected devices use “peer-to-peer” features (also known as “P2P”) that allow users to connect to their devices the moment they come online. Hackers are able to exploit flaws in these features to rapidly find vulnerable cameras, then launch attacks to access them – all without the owner’s knowledge.

Over 2 million vulnerable devices have been identified on the Internet, including those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight, and HVCAM. Affected devices use a component called iLnkP2P. Unfortunately, iLnkP2P is used by hundreds of other brands as well, making identification of vulnerable devices difficult.

Am I affected?

Vulnerable devices will have a special serial number known as a UID, which is typically printed on a label somewhere on the device.

A UID will look like: FFFF-123456-ABCDE

UID label on a vulnerable HiChip device ('FFFF' prefix)

In this example, FFFF is the device’s prefix. Devices with the following prefixes are known to be vulnerable:

AID AJT AVA BSIP CAM
CPTCAM CTW DFT DFZ DYNE
EEEE ELSA ESN ESS EST
FFFF GCMN GGGG GKW HDT
HHHH HRXJ HVC HWAA HZD
HZDA HZDB HZDC HZDN HZDX
HZDY HZDZ IIII IPC ISRP
JWEV KSC MCI MCIHD MDI
MDIHD MEG MEYE MGA MGW
MIC MICHD MMMM MSE MSEHD
MSI MSIHD MTE MTEHD MUI
MUIHD NIP NIPHD NPC NTP
OBJ OPCS OPMS PAR PARC
PCS PHP PIO PIPCAM PIX
PNP PSD PTP QHSV ROSS
SID SIP SXH TIO TSD
UID VIO VSTD VSTF WBT
WBTHD WNS WNSC WXH WXO
XDBL XTST ZES ZLD ZSKJ
ZZZZ

What can I do?

Ideally, buy a new device from a reputable vendor. Research suggests that a fix from vendors is unlikely, and these devices are often riddled with other security problems that put their owners at risk.

If disposing of the device is not possible, the P2P functionality may be effectively neutered by blocking outbound traffic to UDP port 32100. This will prevent devices from being accessed from external networks via P2P (though local access will still work).

More Information

What is P2P? What is iLnkP2P?

P2P is a feature included in many devices that allows them to be accessed without any manual configuration. By using a special serial number known as a UID, users may instantly connect to their device from their phone or computer. A main selling point of P2P devices is that they do not require port forwarding or dynamic DNS in order to be accessed, and are capable of overcoming NAT and firewall scenarios automatically.

iLnkP2P is one of several P2P solutions utilized by device manufacturers. It was developed by Shenzhen Yunni Technology Company, Inc.

What is CVE-2019-11219?

CVE-2019-11219 refers to an enumeration vulnerability in iLnkP2P that allows attackers to rapidly discover devices that are online. Due to the nature of P2P, attackers are then able to directly connect to arbitrary devices while bypassing firewall restrictions.

What is CVE-2019-11220?

CVE-2019-11220 refers to an authentication vulnerability in iLnkP2P that allows attackers to intercept connections to devices and perform man-in-the-middle attacks. Attackers may use this vulnerability to steal the password to a device and take control of it.

Are all P2P devices vulnerable to these issues?

No. There are several different P2P solutions in use by different vendors. These issues are specific to devices that use iLnkP2P.

Is P2P the same as UPnP?

No. P2P is not related to UPnP in any way, and will function regardless of UPnP configuration.

My device encrypts traffic. Am I safe?

Probably not. Analysis of a wide range of devices has suggested that most devices do not employ encryption at all, or do so in an insecure fashion. Some vendors (notably VStarcam) have gone as far as outright lying about their use of encryption.

I don’t know my UID. Is there another way to determine if I am affected?

Devices that use the following Android apps may be vulnerable:

  • HiChip: CamHi, P2PWIFICAM, iMega Cam, WEBVISION, P2PIPCamHi, IPCAM P
  • VStarcam: Eye4, EyeCloud, VSCAM, PnPCam
  • Wanscam: E View7
  • NEO: P2PIPCAM, COOLCAMOP
  • Sricam: APCamera
  • Various: P2PCam_HD

Who are you?

I am Paul Marrapese, an OSCP-certified security engineer from the Bay Area, California. These vulnerabilities were discovered and reported by me as part of an independent research effort.

Have any questions? Feel free to send me an e-mail or DM me on Twitter.

Disclosure timeline

Date Event
Jan. 15, 2019 Initial advisory issued to device vendors.
Jan. 17, 2019 No responses received. 2nd advisory issued to vendors.
Jan. 24, 2019 No responses received. 3rd advisory issued to vendors with intent to disclose.
Feb. 4, 2019 Developer of iLnkP2P identified. Initial advisory issued to developer with intent to disclose.
Feb. 14, 2019 No responses received. 2nd advisory issued to developer.
Feb. 19, 2019 No responses received. Vulnerabilities reported to CERT/CC.
~Apr. 1, 2019 CERT/CC relays vulnerabilities to CNCERT/CC.
Apr. 11, 2019 CVE-2019-11219 and CVE-2019-11220 reserved by MITRE.
Apr. 24, 2019 Public disclosure.