Inadvertantly flashed Chinese DS-2CD6424FWD-20 (R6)

[eiyrfludarsuerxbhk]

I acquired a secondhand DS-2CD6424FWD-200120190605BBRR[serial] which had Chinese firmware v5.5.5_180314.

After reading various posts it was clear one does not simply replace Chinese firmware. My intention was to use the SDK demo software and Batch Configuration tool to configure the camera in English.

However... Due to poor multitasking I accidentally left the Hikvision tftp server running when the camera was rebooted (app was one of several open windows - doh) and subsequently to my dismay discovered it had attempted to flash the English version of v5.5.5 I'd earlier put in the tftp folder.

It got as far as "Completed file[filepath] transmitting", but never made it to a success message (more than 30 minutes would have passed).

The camera currently responds to ping (192.168.1.64) and shows up in SADP as being V4.0.8build 150325, which I understand to mean that it's running in recovery mode.

No telnet or SSH (or HTTP). The SDK demo software can log in to the camera via admin/12345, but can't get or set any settings. Similar the Batch Configuration tool can see the camera, but reports the ConfigurationStatus as unknown, and cannot access remote configuration or camera preview.

A reset of the camera hasn't improved anything.

The brickfix method can't be used as it's an R6 rather than R0 model, and as it's meant to be v5.5.5 the downgrade method can't be used. I haven't seen anything relevant in other posts viewed so far, but may have missed something obvious.

I'm vaguely hopeful that flashing the Chinese v5.5.5_180314 via tftp would resolve things, but I haven't been able to find a copy anywhere.

Does anyone have any suggestions? (Other than being more careful next time!)

 

[alastairstevenson]

As a long shot, I wonder if any of these are for the R6 series, if you haven't already looked here :
The download at 'twenty one' DS-2CD6xxx seems to be for a G3. Maybe the serial number would help.

安全固件升级程序包

www.hikvision.com

 

[eiyrfludarsuerxbhk]

As a long shot, I wonder if any of these are for the R6 series, if you haven't already looked here :
The download at 'twenty one' DS-2CD6xxx seems to be for a G3. Maybe the serial number would help.

安全固件升级程序包

www.hikvision.com

Thanks for the response

Firstly, having seen your name crop up numerous times across various threads - .

That download contains firmware for IPCG_C_G5_CN_STD_5.7.14_210628 and IPCM_G3_CN_STD_5.5.802_210628, both of which are around double the size of the firmware for the English-equivalent firmware for the R6 series.

Serial number is 23475[4 more digits].

I haven't seen that page before, so it does give me something to look at further (slightly confusing that the model numbers bleed across ranges rather than being clearly separate). Thanks!

 

[iTuneDVR]

m vaguely hopeful that flashing the Chinese v5.5.5_180314 via tftp would resolve things, but I haven't been able to find a copy anywhere.

Does anyone have any suggestions? (Other than being more careful next time!)

For the R6 series, there should not be any problems with the firmware patch in general to make a European out of a Chinese.
Yes, the methods for R0 will not fit here explicitly. Pure chinise R6 didn’t fall into my hands, however, the firmware for R6 is not so difficult to assemble, the main thing is to make the right patch for current tasks.
Either in the Chinese version, get extended functionality, or make the Chinese version European, or pull on the European firmware so that it does not fall. Everything is possible, it would make sense to do this, waiting and time, although the model is far from new.

 

[eiyrfludarsuerxbhk]

I haven't seen that page before, so it does give me something to look at further (slightly confusing that the model numbers bleed across ranges rather than being clearly separate). Thanks!

I checked this list for R6 models - R6 series firmware - see models list - and then downloaded from 安全固件升级程序包 the firmware files for model numbers which appeared in the list.

Unfortunately no R6 or version number that matched 5.5.5 180314.

I case it helps anyone else, these were:
02: DS0-2CD1xxxx
IPC_E0_CN_STD_5.4.800_210813.zip
IPC_E1_CN_STD_5.5.800_210816.zip
IPC_E2_CN_STD_5.5.800_210818.zip
IPC_E4_CN_STD_5.5.801_210817.zip
IPC_E6_CN_STD_5.5.803_210817.zip
IPC_R0_CN_STD_5.4.800_210813.zip
IPC_R2_CN_STD_5.4.800_210813.zip
IPCR_E3_CN_STD_5.5.800_210628.zip

06: DS-2CD2xxx
IPC_E1_CN_STD_5.5.800_210816.zip
IPC_E2_CN_STD_5.5.800_210818.zip
IPC_E3_CN_STD_5.5.800_210628.zip
IPC_E4_CN_STD_5.5.801_210817.zip
IPCE_E8_CN_STD_5.7.0_210806.zip
IPCE_R_E8_CN_STD_5.7.0_210806.zip
IPC_G2_CN_STD_5.5.800_210628.zip
IPC_G3_CN_STD_5.5.800_210628.zip
IPC_G5_CN_STD_5.5.800_210628.zip
IPCH_E7_CN_STD_5.5.800_210816.zip
IPC_R0_CN_STD_5.4.800_210813.zip
IPC_R2_CN_STD_5.4.800_210628.zip
IPCR_E3_CN_STD_5.5.800_210628.zip

26: iDS-2XM
IPC_E2_BV_CN_STD_5.4.800_210812.zip
IPCG_E_H8_CN_STD_5.7.10_210701.zip

And from above, 21: DS-2CD6
IPCG_C_G5_CN_STD_5.7.14_210628.zip
IPCM_G3_CN_STD_5.5.802_210628.zip

---
And because why not, these are all the others:

01: DS-2CVxxxx
IPC_E0_CIVIL_CN_STD_5.4.800_210820.zip
IPC_E2_CIVIL_CN_STD_5.4.800_210820.zip

03: IPCxx
IPC_E6_CN_STD_5.5.803_210817.zip
IPC_E7_CN_STD_5.5.800_210816.zip
IPC_E7S_CN_STD_5.5.800_210816.zip
IPCE_E8_CN_NEU_5.7.0_210806.zip

04: DS-IPC-Bxx, Txx
IPC_E4_CN_STD_5.5.801_210817.zip
IPC_E6_CN_STD_5.5.803_210817.zip
IPC_E7_CN_STD_5.5.800_210816.zip
IPC_E7S_CN_STD_5.5.800_210816.zip
IPCE_E8_CN_STD_5.7.0_210806.zip

05: DS-IPC-Exx, Sxx, Axx, DS-2XDxxxx
IPCK_E6_CN_STD_5.5.803_210817.zip
IPCK_E7_CN_STD_5.5.800_210816.zip
IPCK_G3_CN_STD_5.5.800_210629.zip
IPCKR_G3_CN_STD_5.5.800_210629.zip
IPCTC_E6_CN_STD_5.5.803_210817.zip
IPCTC_E7_CN_STD_5.5.800_210816.zip
IPCTC_G3_CN_STD_5.5.800_210629.zip
IPCTCR_G3_CN_STD_5.5.800_210629.zip

07: DS-2CD3xxx
IPC_E7_CN_STD_5.5.800_210816.zip
IPC_E7S_CN_STD_5.5.800_210816.zip
IPCE_R_E8_CN_STD_5.7.0_210806.zip
IPC_G3_CN_STD_5.5.800_210628.zip
IPC_G5_CN_STD_5.5.800_210628.zip
IPC_R0_CN_STD_5.4.800_210813.zip
IPCR_E3_CN_STD_5.5.800_210628.zip

08: (i)DS-2DCxxxx
IPD_E2_CN_STD_5.3.800_210813.zip
IPDE_E7_CN_STD_5.6.800_210628.zip
IPDE_L_H8_CN_STD_5.7.0_210701.zip
IPDZLF_G3_CN_STD_5.5.800_210628.zip

09: (i)DS-2DExxxx
IPD_E2_CN_STD_5.3.800_210813.zip
IPDE_E7_CN_STD_5.6.800_210628.zip
IPDE_L_H8_CN_STD_5.7.0_210701.zip
IPDM_G1_CN_STD_5.5.800_210630.zip
IPD_R0_CN_STD_5.4.800_210812.zip

10: (i)DS-2PTxxxx
IPDE_E7_CN_STD_5.6.800_210628.zip
IPDE_H8_CN_STD_5.7.0_210701.zip
IPD_H7_CN_STD_5.5.800_210628.zip
IPDPF_H5_CN_STD_5.5.800_210628.zip

11: (i)DS-2SE7xxxx
IPDZLF_G3_CN_STD_5.5.800_210628.zip

12: DS-2DBxxxx
IPZEX_E7_CN_STD_5.6.800_210628.zip
IPZEX_G3_CN_STD_5.5.800_210628.zip

13: DS-2DYHxxxx
IPTH_H5_CN_STD_5.5.800_210628.zipIPTH_H5_CN_STD_5.5.800_210628.zip

14: DS-2DY9xxxx
IPD_H5_CN_STD_5.5.802_210709.zip
IPDOME_EX_H5_CN_STD_5.5.800_210701.zip
IPTM_H8_CN_STD_5.7.0_210628.zip
IPYT_H7_CN_STD_5.5.800_210628.zip

15: iDS-2DY5Cxxx
IPYT_G5H7_CN_STD_5.5.800_210628.zip

16: iDS-2DP9Cxxx-T4
IPDPEX_H5H3_CN_STD_5.5.800_210702.zip

17: DS-2DY7xxx-CX(S5), 2DF6xxx-CX(S6), 2DF6Cxxx-CX(T2)
IPDEX_E7_CN_STD_5.6.800_210628.zip
IPDOME_EX_H5_CN_STD_5.5.800_210701.zip
IPYTEX_G3_CN_STD_5.5.800_210628.zip

18: iDS-2VY4xxxx
IPTMTF_H7_CN_STD_5.5.800_210628.zip

19: iDS-EGDxxxx
IPDPF_H5_CN_STD_5.5.800_210628.zip

20: DS-2CD4xxx, 5xxx
IPCG_L_H8_CN_STD_5.7.11_210628.zip
IPC_H1_CN_STD_5.4.800_210812.zip
IPCHE_G3_CN_STD_5.5.800_210630.zip
IPC_R2_CN_STD_5.4.800_210812.zip

22: DS-2CD7xxx, DS-GPZxxx
IPCG_G5_CN_STD_5.7.20_210626.zip
IPCG_H8_CN_STD_5.7.0_210630.zip
IPCG_H_H8_CN_STD_5.7.0_210630.zip
IPC_H5_CN_STD_5.5.800_210628.zip
IPC_H5_CN_STD_5.5.801_210628.zip
IPC_H5_CN_STD_5.5.802_210628.zip
IPC_H5_CN_STD_5.5.803_210628.zip
IPCH_G3_CN_STD_5.5.800_210628.zip
IPCH_G3_CN_STD_5.5.801_210630.zip
IPCH_G3_CN_STD_5.5.802_210630.zip
IPCH_G3_CN_STD_5.5.804_210630.zip
IPCM_G3_CN_STD_5.5.800_210628.zip
IPCM_G3_CN_STD_5.5.801_210628.zip
IPCM_G3_CN_STD_5.5.802_210628.zip
IPCM_G3_CN_STD_5.5.803_210706.zip
IPCM_G3_CN_STD_5.5.804_210630.zip
IPCM_G3_CN_STD_5.5.805_210630.zip
IPCM_G3_CN_STD_5.5.806_210630.zip

23: DS-2CD8xxx
IPCG_L_G5_CN_STD_5.5.800_210628.zip
IPC_H5_CN_STD_5.5.805_210628.zip
IPCM_G3_CN_STD_5.5.800_210628.zip

24: DS-2XA8xxx
IPC_AI_G3_CN_STD_5.5.800_210628.zip

25: DS-FCNxxx
IPCG_L_H8_CN_STD_5.7.11_210628.zip

27: DS-2DF5, 6, 7, 8, 9xxx, DS-2DF6xxx-CX
IPDEX_E7_CN_STD_5.6.800_210628.zip
IPD_H1_CN_STD_5.4.800_210628.zip
IPD_H5_CN_STD_5.5.800_210628.zip
IPD_H5_CN_STD_5.5.801_210628.zip
IPD_H5_CN_STD_5.5.803_210629.zip
IPD_H7_CN_STD_5.5.800_210628.zip
IPD_H7_CN_STD_5.5.801_210628.zip
IPD_H8_CN_STD_5.7.1_210712.zip
IPDHG_H5_L1_CN_STD_5.5.801_210701.zip
IPDHG_H8_CN_STD_5.7.2_210626.zip
IPDS_H5_CN_STD_5.5.800_210702.zip
IPDS_H7_CN_STD_5.5.800_210703.zip

28: iDS-2VPDxxxx, 2DPxxxx
IPDPEX_H5H3_CN_STD_5.5.800_210702.zip
IPDP_H5_CN_STD_5.5.800_210628.zip

29: iDS-2PT9xxx
IPQ_H5_CN_STD_5.5.800_210702.zip
IPQ_H8_CN_STD_5.7.0_210626.zip
IPQHG_H5_CN_STD_5.5.800_210628.zip

30: iDS-2SK7、8xxx
IPDZLF_H5_CN_STD_5.5.800_210628.zip
IPDZLFS_H5_CN_STD_5.5.800_210629.zip

31: iDS-SR8xxx
IPRD_H5_CN_STD_5.5.800_210628.zip

32: iDS-2VSxxxx
IPDTF_H5_CN_STD_5.5.800_210628.zip
IPDTF_H7_CN_STD_5.5.800_210701.zip

33: iDS-2VTxxxx
IPDZLF_TF_H5_CN_STD_5.5.800_210628.zip

34: iDS-GPZ2xxx
IPDPL_H7_CN_STD_5.5.800_210628.zip

35: DS-2XE, XC6xxx
IPCH_E8_CN_STD_5.5.800_210823.zip
IPCH_EX_E7_CN_STD_5.5.800_210811.zip
IPCH_EX_G3_CN_STD_5.5.800_210628.zip

36: KBA18(c)-8xxx
IPCH_EX_G3_CN_STD_5.5.801_210628.zip

37: DS-TBxxx, DS-Bxxxx, DS-2TDxxxxB, TBC-12xxx, TBC-26xxx
IPTCB_G5_CN_STD_5.5.38_210702.zip
IPTCB_H7_CN_STD_5.5.34_210702.zip

38: DS-TD1xxx, DS-2TD2xxx
IPHC_H1_CN_STD_5.5.8_210702.zip
IPHC_H3_CN_STD_5.5.22_210702.zip
IPHC_H7_CN_STD_5.5.42_210721.zip
IPTC_G5_CN_STD_5.5.40_210720.zip
IPTCS_H3_CN_STD_5.5.22_210702.zip

39: DS-2TD51xx-xx, DS-2TD55xx-xx, DS-2TD65XX-XX
IPTM_H5_CN_STD_5.5.31_210702.zip

40: DS-2TD41xx-xx, DS-TD62xx-xx, DS-2TD81xx-xx, DS-2TD91xx, DS-2TD4xxx, DS-2TD55xx, DS-TD6xxx
IPTM_H3_CN_STD_5.5.39_210702.zip
IPTM_H5_CN_STD_5.5.33_210729.zip

41: DS-76xxN-Exxxxx, DS-78xxN-Kxxxxx, DS-NVR-K1xx, DS-NVR-K2xx
DS-78xxN-K1 K2(xPбвxN)(-C)(D)бвDS-NVR-K1 K2xx(xP)(-C)
DS-7604N-E1-V3бвDS-7604N-E1(P)бвDS-7608бв16N-Ex-V3(P)

 

[eiyrfludarsuerxbhk]

Thanks for your reply. Apologies, but I don't entirely follow what you're saying, other than essentially there should be several ways to fix things (which sounds promising).

As per above for my purposes I'd be happy enough with working Chinese firmware, and don't require European/English (though am not opposed).

however, the firmware for R6 is not so difficult to assemble, the main thing is to make the right patch for current tasks.
Either in the Chinese version, get extended functionality, or make the Chinese version European, or pull on the European firmware so that it does not fall.

It appears you're saying it shouldn't be too difficult to create an R6 firmware which appears to be CN v5.5.5 180314 (to trick the camera into thinking it's the correct version). I've seen info for this for other models, but have also seen comments stating the R6 series is different.

It would be appreciated if you could either expand on your comments or point me in the right direction.

 

[rearanger]

There are many methods to get a Chinese cam to run as a European/english cam.

You would need full shell access or way to repack firmware or hardware flash.

Just get any version of Chinese firmware working on the cam. Then take it from there. Don't get too hung up on the version number.(although many cams will not let you downgrade)

if your R6 is is vulnerable to the new CVE backdoor i would not apply firmware fixed version.(if that is only root access method)

 

[eiyrfludarsuerxbhk]

Thanks for your reply.

There are many methods to get a Chinese cam to run as a European/english cam.

You would need full shell access or way to repack firmware or hardware flash.

At this point I'm looking to get the camera out of recovery mode by flashing it with the original Chinese firmware via tftp.

If you or anyone else is able to suggest a different method to get the camera working again then happy to hear it.

Just get any version of Chinese firmware working on the cam. Then take it from there. Don't get too hung up on the version number.(although many cams will not let you downgrade)

My understanding is that what's required is firmware for the Chinese R6 series at a version level of v5.5.5 180314 or above.

I haven't seen anything which suggests it's possible to use a version lower than 5.5.5, or from another model series. (But I have seen numerous comments here and elsewhere suggesting it's important to ensure the right firmware is used.)

Again, if you or anyone else is able to indicate differently then happy to hear it

 

[alastairstevenson]

Unfortunately no R6 or version number that matched 5.5.5 180314.

I case it helps anyone else, these were:

Wow!
That's a massive list, everything but an R6 firmware.
Odd that it's missing - unless the list only covers models subject to the current RCE vulnerability.
You must have downloaded a few GB of data.

 

[eiyrfludarsuerxbhk]

Wow!
That's a massive list, everything but an R6 firmware.
Odd that it's missing - unless the list only covers models subject to the current RCE vulnerability.
You must have downloaded a few GB of data.

Figured it would be a futile exercise for me, but maybe help someone in the future similarly searching for a specific version.

Just under 17GB

All the files are hosted on AWS, so speed not so bad.

 

[watchful_ip]

I checked this list for R6 models - R6 series firmware - see models list - and then downloaded from 安全固件升级程序包 the firmware files for model numbers which appeared in the list.

Wow. That sure is a lot of firmware dated right at the end of June 2021.

Wonder what happened?

 

[alastairstevenson]

Wonder what happened?

Yes, very odd.

 

[eiyrfludarsuerxbhk]

Yes, very odd.

For those unaware, Unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260).

 

[eiyrfludarsuerxbhk]

And surely someone must have an R6 series camera with Chinese firmware at or above v5.5.5?

 

[watchful_ip]

For those unaware, Unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260).

Interesting!
Though looks like that guy can't write a blog post to save his/her life. Those colours ouch!

 

[eiyrfludarsuerxbhk]

I've never seen a Chinese IPC_R6. I'm not sure it was ever issued under that name. Others might know better though.

Can we see a picture of the label? Feel free to blank out the serial/MAC - but please leave the first 4 digits of the serial.

Was the day of the week on the OSD in Chinese when the camera was working?

I assume it's an R6 as it appeared in the list of devices for R6 - DS-2CD6424FWD-20.

The first 4 digits of the serial are 2347.

The label text is all in Chinese other than the factual details.

All of the OSD was in Chinese other than the numeric time representation.

 

[watchful_ip]

That's an early serial number. I wonder if it's an IPC_R1 not an IPC_R6.

I'd recommend flashing CN IPC_R1 to it. If it's the wrong firmware it should be rejected. In either case it won't affect the bootloader/recovery partitions so I don't see a risking of bricking.

 

[eiyrfludarsuerxbhk]

Thanks for the suggestion. Where do I locate IPC_R1 firmware? It doesn't appear to be amongst the 17GB of Hikvision firmware files I've downloaded.

 

[watchful_ip]

Having said that I can't find a EN IPC_R1 that's 5.5.5 either so perhaps that isn't right and it is a IPC_R6.

Do you only have one of these cameras?

 

[eiyrfludarsuerxbhk]

Do you only have one of these cameras?

Yes. Otherwise I'd try to export the firmware from one of the other ones and use that file to fix my cock-up