Security Notification- Buffer Overflow Vulnerability in Some Hikvision IP Cameras
- Thread starter fenderman
- Start date
fenderman
Staff member
- Joined
- Mar 9, 2014
- Messages
- 36,903
- Reaction score
- 21,275
why are you bothering upgrading? there is no risk unless you are port forwarding which is stupid even with the latest update...
alastairstevenson
Staff member
Definitely using IE11 with webcomponents installed?
Did you update webcomponents after the update?
alastairstevenson
Staff member
Some options in the web GUI depend upon the plugin for service.
Such as browsing for firmware files to upgrade with.
After some hours of work I´ve eventually managed to resolve this issue: I couldn´t install any new webcomponents because of this live view failure. I tested it with various browsers, so it ended with installing Hikvision´s iVMS tool and I was happy to find this upgrade option there again. I could sucessfully downgrade the firmware to 5.5.5.
its been over 90 Days and the vdoo group have released info about CVE-2018-6414
Significant Vulnerability in Hikvision Cameras
any one have try/success to make it work ?
Significant Vulnerability in Hikvision Cameras
any one have try/success to make it work ?
alastairstevenson
Staff member
Interesting.
That looks like a good candidate for a bot to either do mischief or enumerate targets.
Thanks for this. It's a nice write-up. I'm impressed with how bad the security of the cameras are. It's like they were designed as examples of what not to do when when writing software for an IoT product. Sad.