{"vulnerability": "cve-2020-2225", "sightings": [{"uuid": "8da9382e-0c66-4815-9776-0cb56772faab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-22253", "type": "seen", "source": "https://t.me/cibsecurity/40274", "content": "\u203c CVE-2020-22253 \u203c\n\nXiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unauthenticated attackers to make arbitrary Telnet connections with the victim device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-07T02:30:38.000000Z"}, {"uuid": "bf38adb2-8f83-465a-9cc2-f8265e2c0e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-22251", "type": "seen", "source": "https://t.me/cibsecurity/25945", "content": "\u203c CVE-2020-22251 \u203c\n\nCross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-07T00:37:07.000000Z"}, {"uuid": "a66f90b9-b86e-4e72-829f-dcdf00444ccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-22253", "type": "seen", "source": "https://gist.github.com/TheFury4/e0e26152e645a7617d2f71d377a37f04", "content": "# Xiongmai XM530: unsigned MicroSD script executed as root (`sd_run.sh`)\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | CAN-2026-2037297 |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-94, CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (MicroSD slot) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera, network traffic, or exploit payload is required.\n\n---\n\n## Summary\n\nThe helper daemon `/usr/bin/dvrHelper` (squashfs path `/bin/dvrHelper`) automatically executes `/home/sd_run.sh` as root when a FAT volume is mounted from the camera MicroSD slot. There is no authentication, digital signature, or integrity check on that script.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| `dvrHelper` SHA-256 | `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8` |\n| `dvrHelper` size | 18,256 bytes |\n\nThe `.bin` is a ZIP of MTD partition images. `dvrHelper` lives in `user-x.cramfs.img` (SquashFS), mounted at `/usr` at runtime.\n\nOther XM530 OEM builds that ship the same `dvrHelper` `sub_AF28` logic may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/init.d/rcS` starts `dvrHelper` as root. In `sub_AF28` the process:\n\n1. Polls `/dev/mmcblk0p1`, then `/dev/mmcblk0`.\n2. Mounts the volume as `vfat` on `/home`.\n3. If `/home/sd_upgrade_all.bin` is absent, checks `/home/sd_run.sh`.\n4. If the script exists: `system(\"rmmod xm_wdt\")`, then  \n   `execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)`.\n\nA physically present attacker who can insert a MicroSD card containing a file named `sd_run.sh` obtains a root shell interpreter. No password, UART, or network access is required.\n\nThis is distinct from the well-known factory hash `xmhdipc` (CVE-2021-41506) and from the TCP/9530 OpenTelnet issue (CVE-2020-22253).\n\n---\n\n## Evidence from this image\n\n### 1. Process start (root)\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/init.d/rcS`\n\n```text\ndvrHelper /lib/modules /usr/bin/app.sh 127.0.0.1 9578 1 &\n```\n\n### 2. Removable-media mount\n\nFile: squashfs `user-x.cramfs.img` \u2192 `/bin/dvrHelper`  \nFunction: `sub_AF28` (IDA ARM listing, file offsets)\n\n```text\n0x0000B07C  LDR   R8, =(aDevMmcblk0p1 - 0xB084) ; \"/dev/mmcblk0p1\"\n0x0000B080  LDR   R9, =(aDevMmcblk0 - 0xB088)   ; \"/dev/mmcblk0\"\n...\n0x0000B090  MOV   R0, R8                         ; name\n0x0000B094  MOV   R1, #0                         ; F_OK\n0x0000B098  BL    access\n...\n0x0000B0A8  LDR   R1, =(aHome - 0xB0B4)          ; \"/home\"\n0x0000B0AC  LDR   R2, =(aVfat - 0xB0BC)          ; \"vfat\"\n...\n0x0000B0E8  MOV   R3, #4                         ; MS_SYNCHRONOUS\n0x0000B0EC  BL    mount\n```\n\n### 3. Unsigned script execution (`loc_B218`)\n\n```text\n0x0000B218 loc_B218:\n0x0000B218   LDR   R4, =(aHomeSdRunSh - 0xB228) ; \"/home/sd_run.sh\"\n0x0000B224   MOV   R0, R4                       ; name\n0x0000B228   BL    access                       ; access(path, F_OK)\n0x0000B22C   SUBS  R8, R0, #0\n0x0000B230   BNE   loc_B274\n0x0000B234   LDR   R0, =(aRmmodXmWdt - 0xB240)  ; \"rmmod xm_wdt\"\n0x0000B23C   BL    system\n0x0000B248   LDR   R0, =(aRunSdRunSh - 0xB254)  ; \"run sd_run.sh!\"\n0x0000B250   BL    printf\n0x0000B254   LDR   R0, =(aBinSh - 0xB26C)       ; \"/bin/sh\"\n0x0000B258   LDR   R1, =(aHomeSdRunSh+0xD)      ; \"sh\"\n0x0000B25C   MOV   R2, R4                       ; \"/home/sd_run.sh\"\n0x0000B260   MOV   R3, R8                       ; NULL\n0x0000B26C   BL    execl                        ; execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)\n```\n\nBetween `access(\"/home/sd_run.sh\")` and `execl` there is no signature, HMAC, or confirmation path.\n\n### 4. `.rodata` strings in the same binary\n\n```text\naDevMmcblk0p1    \"/dev/mmcblk0p1\"\naDevMmcblk0      \"/dev/mmcblk0\"\naHome            \"/home\"\naVfat            \"vfat\"\naHomeSdRunSh     \"/home/sd_run.sh\"\naRmmodXmWdt      \"rmmod xm_wdt\"\naRunSdRunSh      \"run sd_run.sh!\"\naBinSh           \"/bin/sh\"\n```\n\nConfirm with:\n\n```text\nstrings dvrHelper | grep -E 'sd_run|mmcblk0|rmmod xm_wdt'\n```\n\nExpected hits include `/home/sd_run.sh` and `run sd_run.sh!`.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the ZIP/firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `user-x.cramfs.img` (SquashFS) and `romfs-x.cramfs.img` (CramFS).\n3. Confirm `/etc/init.d/rcS` contains the `dvrHelper ... 9578 1` line.\n4. Hash `bin/dvrHelper`; it must match  \n   `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8`.\n5. `strings` / disassemble `dvrHelper` and match `loc_B218` above.\n\nThat is sufficient to establish the vulnerability. A camera is not required.\n\n---\n\n## Impact\n\nRoot code execution from the external SD slot. The same function can also invoke `/var/upgrader` on `/home/sd_upgrade_all.bin` if that file is present; that path is out of scope for this CVE request.\n\n---\n\n## Remediation\n\nRemove automatic execution of `/home/sd_run.sh` from production firmware. If factory tooling still needs an SD hook, require an asymmetric signature over the script and fail closed.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR (CAN-2026-2037297) |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:26:45.197628Z"}]}