Annke N48PBB NVR vulnerability

[watchful_ip]

If you have one of these on the Internet you might want to update. And reconsider having any IoT exposed to the internet in the first place

New Annke Vulnerability Shows Risks of IoT Security Camera Systems

Nozomi Networks Labs has discovered a remote code execution vulnerability in the Annke N48PBB network video recorder. A patch is available.

www.nozominetworks.com

 

[alastairstevenson]

That seems like a fast response by Annke to the disclosure.
Presumably a device of their own manufacture, not an OEM product.

 

[aamuk]

I thought the Annke N48PBB was one of their Hikvision oem NVRs.

Oh, there’s a picture of the mainboard in the Nozomi article:

It says on it DS-80325_P.

 

[alastairstevenson]

I thought the Annke N48PBB was one of their Hikvision oem NVRs.

Certainly the sample HTTP dialog is of Hikvision flavour.

 

[watchful_ip]

I looked at the firmware - it is Hikvision OEM.

But the vulnerable code looks to have been added by Annke themselves, as the Hikvision firmware doesn't seem to have it (though I didn't check everything so might have missed it, but I am sure it would have been noted).

The fast response may have been because the fixed firmware has a build date in April - before the vulnerability was reported.