IP Camera DS-2CD3T20D-l3

[adamf77]

Hi, I got this off ebay - its identified as a DS-2CD3T20D-l3

I can log into the web GUI with user admin no password and see no options to configure etc

everything is in chinese.

i have used google translate to translate the web page but there is no config / admin / configure option anywhere.



anyone have any ideas ?

thanks in advance

 

[TonyR]

You could try Hikvision's Search Active Device Protocol (SADP) tool .. located about 3/4 of the way down the page. I would be surprised if you're able to update any firmware, though.
Good luck and welcome to IPCT !

 

[Oleglevsha]

This is a product of XM Xiongmai
You need an Internet Explorer browser, go to the web interface page of the camera, download the plugin, login admin password is empty

 

[TonyR]

A Google search of the model says it's a "Hikvision" but if is XM Xiongmai as @Oleglevsha says, I'd proceed with caution;

MILLIONS OF XIONGMAI VIDEO SURVEILLANCE DEVICES CAN BE HACKED VIA CLOUD FEATURE (XMEYE P2P CLOUD)

 

[alastairstevenson]

Much of the Xiongmaitech firmware has a 'Hikserver' function that supports a subset of the Hikvision API.
This allows SADP to find it, and even allow config changes.
And confusingly there is a hardcoded model that looks like a Hikvision one.

 

[Oleglevsha]

A Google search of the model says it's a "Hikvision" but if is XM Xiongmai as @Oleglevsha says, I'd proceed with caution;

MILLIONS OF XIONGMAI VIDEO SURVEILLANCE DEVICES CAN BE HACKED VIA CLOUD FEATURE (XMEYE P2P CLOUD)

Do not rush in vain to tarnish the reputation of the manufacturer, the same can be found in relation to Hikvision or DAHUA

 

[adamf77]

This is a product of XM Xiongmai
You need an Internet Explorer browser, go to the web interface page of the camera, download the plugin, login admin password is empty

i get the same as in Chrome... just the video player.. no options to configure or anything

 

[alastairstevenson]

You need an Internet Explorer browser, go to the web interface page of the camera, download the plugin, login admin password is empty

Chrome longer supports NPAPI plugins - as advised by @Oleglevsha you must use IE11. Not Edge.

 

[Oleglevsha]

Hangzhou Xiongmai Technology Co.,LTD.-Complete software

www.xiongmaitech.com

 

[adamf77]

Thank you all

i had to do the following:

In Internet Explorer (not EDGE)

Add the site to trusted sites, then change the security level of trusted sites to custom ->low

this then loaded the applet and showed the hidden menus

 

[TonyR]

Do not rush in vain to tarnish the reputation of the manufacturer, the same can be found in relation to Hikvision or DAHUA

I did not rush and it was not in vain. Besides, I did not tarnish anything....they did.

 

[alastairstevenson]

I believe it was a valid warning.
XM firmware is more riddled with vulnerabilities than most. And they are much less inclined to fix them than Hikvision or Dahua.

 

[Oleglevsha]

The data mentioned in this article is out of date, these vulnerabilities have been fixed, remote firmware update requires counting of the control amount, the counting algorithm is not published, the telnet is closed, the listed ports are closed.
You can still download a modified firmware version locally while on the same network as the device.
Or do you want to add a digital signature to the loader?
How it was done in the brands Dahua, Hikvision
Together, you will lose the ability to embed additional features in the firmware, it's independent cloud customers or data broadcast to YouTube.
sending screenshots of an alarming event to social media, creating a secure connection through a VPN...
My opinion is that there is no need for the manufacturer to close all the possibilities for moding devices, it is enough to ensure the safety of the device on the Internet, inside the network the user should take care of his devices.