Menu
What's new

Unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260)

J

john-ipvm

Known around here
Joined
Oct 15, 2015
Messages
420
Reaction score
675
korin1 said:
does that effect hilook aswell?
Click to expand...
Yes. Hilook cameras generally start with IPC- prefix, e.g., see screencap attached from Value Cameras The Hikvision disclosure says "IPC-xxxx" are impacted. I don't know all the model numbering of Hilook but minimally those IPC- ones are listed as impacted.

Related, Hiwatch, another Hikvision sub-brand is impacted as Hikvision includes HWI-xxxx, which is the general prefix for Hiwatch cameras.
 

Attachments

Last edited:
K

korin1

Young grasshopper
Joined
Aug 27, 2017
Messages
45
Reaction score
8
watchful_ip said:
Hi - I did think about posting in the cyber security thread but I don't think it would have been seen by as many people with Hikvision cameras/NVRs. I'll make a quick post there now, though if that's against forum rules (duplicate post) mods feel free to delete :)

I'm not familiar with Hilook sorry.
Click to expand...
Perhaps mods can move it .

I can find a hilook device if you'd like , so you can try and see if this effect them aswell

Anyhow good job
 
T

tallguydirk

n3wb
Joined
May 11, 2020
Messages
9
Reaction score
2
Location
va
I have the following cameras - can anyone confirm whether or not they're impacted? Based on this list of impacted models listed here I think none of them are impacted but I want a sanity check to make sure I'm not misreading something:
DS-2CD2332-I
DS-2CD3332-I
DS-2CD2312-I
DS-2CD2542FWD
 
watchful_ip

watchful_ip

Pulling my weight
Joined
Nov 24, 2019
Messages
251
Reaction score
226
Location
london
Those look to be IPC_R0 and IPC_R6 and you should be fine.

A good rule of thumb, is to check the Hikvision's Global Firmware site, and if there's new firmware for your camera there apply it (assuming it's a non-imported camera).

And as I said in my report, it is not recommended to put any IoT device made by anyone directly on the Internet if it's avoidable.
 
K

korin1

Young grasshopper
Joined
Aug 27, 2017
Messages
45
Reaction score
8
alastairstevenson said:
Be aware though that on the R0 cameras, any firmware that's older than 5.4.5 will have the 'Hikvision backdoor' vulnerability making it readily hacked if exposed.
Click to expand...
3-4 year old firmware..

This all depends on be able to download the configuration file no?
 
B

Bink

Getting the hang of it
Joined
May 25, 2017
Messages
76
Reaction score
28
The write-up specifically notes this affects the HTTP/HTTPS ports. Anyone know if this has any effect on the camera’s “Server” and/or RTSP ports? Typically ports 8000 and 554, respectively.
 
watchful_ip

watchful_ip

Pulling my weight
Joined
Nov 24, 2019
Messages
251
Reaction score
226
Location
london
Bink said:
The write-up specifically notes this affects the HTTP/HTTPS ports. Anyone know if this has any effect on the camera’s “Server” and/or RTSP ports? Typically ports 8000 and 554, respectively.
Click to expand...
"Only access to the http(s) server port (typically 80/443) is needed. "
 
mat200

mat200

IPCT Contributor
Joined
Jan 17, 2017
Messages
13,894
Reaction score
23,183
Bink said:
The write-up specifically notes this affects the HTTP/HTTPS ports. Anyone know if this has any effect on the camera’s “Server” and/or RTSP ports? Typically ports 8000 and 554, respectively.
Click to expand...
In general, if a product has a webserver it can be running on the typical ports .. 80, 8000, 8080 .. often I see systems which have less resources only using one webserver software for multiple ports ..
( as well as the usual https ports )
 
B

Bink

Getting the hang of it
Joined
May 25, 2017
Messages
76
Reaction score
28
watchful_ip said:
"Only access to the http(s) server port (typically 80/443) is needed. "
Click to expand...
I appreciate a reply from the authority here—thank you. “Only access” is quite different from “this vulnerability is limited to the web server that is normally exposed on ports 80 and 443,” but I grasp what you highlighted.
 
A

alekk

Pulling my weight
Joined
Aug 13, 2018
Messages
114
Reaction score
127
Location
Republic of Boulder
Wooooo ... as a network/security admin in a previous life, this is some serious sh*t ...
That is an EXCELLENT report @watchful_ip - well done ... and the community (and hopefully Hikvision) thanks you.

It's a bit confusing trying to figure out exactly what models/firmware is affected.
For example, I have a DS-2CD2735FWD-IZS running firmware 5.6.3 (190923)
That specific model is NOT in the "xx" model list ... plus 5.6.3 appears to be "newer" that the affected firmware's of (mostly) 5.5.xxxx

But just to be sure I check Hikvision's firmware ... ummmmm ... can't see anything for the 2735 (oversight?) ... but there IS firmware for the very similar 2725 and 2745 (confirms the oversight?) that is Firmware_V5.6.6_210625 ... so I'm of the opinion that I should apply this - yes?
 
watchful_ip

watchful_ip

Pulling my weight
Joined
Nov 24, 2019
Messages
251
Reaction score
226
Location
london
alekk said:
Wooooo ... as a network/security admin in a previous life, this is some serious sh*t ...
That is an EXCELLENT report @watchful_ip - well done ... and the community (and hopefully Hikvision) thanks you.

It's a bit confusing trying to figure out exactly what models/firmware is affected.
For example, I have a DS-2CD2735FWD-IZS running firmware 5.6.3 (190923)
That specific model is NOT in the "xx" model list ... plus 5.6.3 appears to be "newer" that the affected firmware's of (mostly) 5.5.xxxx

But just to be sure I check Hikvision's firmware ... ummmmm ... can't see anything for the 2735 (oversight?) ... but there IS firmware for the very similar 2725 and 2745 (confirms the oversight?) that is Firmware_V5.6.6_210625 ... so I'm of the opinion that I should apply this - yes?
Click to expand...
Thanks :)

That looks to be an IPC_G1 camera, and as such is fine.

Affected IP Camera Firmware Types
 
Last edited:
A

alekk

Pulling my weight
Joined
Aug 13, 2018
Messages
114
Reaction score
127
Location
Republic of Boulder
Thanks @watchful_ip ... although I was surprised that Hikvision has recent firmware for that G1 - link to European Portal (and release notes there show it applies to the 2735).

Another camera I have is the 5526G0 ... which I believe (?) is in the H3 family. That also appears NOT to be affected ... so maybe I dodged a bullet on this one!
Good thing since that specific camera is an early model and won't take upgrades beyond 5.5.91 ... I did ask Hikvision and they said sent it back and pay for service to possibly fix.
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,952
Reaction score
6,786
Location
Scotland
A couple more media reports on this latest Hikvision vulnerability :
www.securityinfowatch.com

Report: Cybersecurity vulnerability could affect millions of Hikvision cameras

Company announces updated firmware version to address the issue
www.securityinfowatch.com www.securityinfowatch.com

portswigger.net

Zero-click RCE vulnerability in Hikvision security cameras could lead to network compromise

Abuse of flaw could give attackers greater access to devices even than its owner
portswigger.net portswigger.net

And the CVE now has some detail filled in :

CVE - CVE-2021-36260

The mission of the CVE® Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities.
cve.mitre.org
 
A

aamuk

n3wb
Joined
Jul 8, 2021
Messages
27
Reaction score
19
Location
UK
Surprisingly (or maybe not), considering the significance and the number of pieces of equipment potentially impacted worldwide, the story’s been on a bit of a slow burn.
 
T

tigerwillow1

Known around here
Joined
Jul 18, 2016
Messages
3,843
Reaction score
8,505
Location
USA, Oregon
Only access to the http(s) server port (typically 80/443) is needed.

I'm concluding from this statement that this particular vulnerability does not apply to P2P. Correct?
 
You must log in or register to reply here.
Top