CVE-2017-8227

CVE-2017-8227 describes a critical authentication bypass vulnerability in Amcrest IPM-721S devices. While the web interface implements account lockout after 30 failed attempts, the ONVIF interface, handled by the same underlying binary, lacks this protection, allowing unlimited brute-force attacks against user credentials. This flaw affects Amcrest IPM-721S and its firmware, specifically versions up to V2.420.AC00.16.R.20160909. The vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. An unauthenticated attacker can exploit this to gain full control over the device. Currently, there is no evidence of active exploitation, nor are there publicly available Metasploit modules, Nuclei templates, or ExploitDB entries. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness despite its critical severity.