Unable to reset Password - Device Denied

Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Hi all;

First and foremost:
I am new to ipcamtalk.com, please accept my upfront apologies if I am posting in the wrong location, and if so, could i respectfully ask that Admin move my post to the correct thread, I have joined the website because I am at the verge of giving up on life it's self, you will see why in a moment...

Background:
In 2016, I purchased two Annke SP1 model IP cameras of Amazon for £20 each, not a bad price, I still use these cameras today, and I wanted to expand the network of CCTV security in the property.
Originally these cameras were intended as baby monitors, but have proven useful in other ways, so I am looking to have one in each main room of the house and maybe expand it to outdoor cameras (since it is rented accommodation, I wasn't in a rush to install permanent fixtures to the building or drill holes into the property walls)

So I recently purchased an Annke i21af model from eBay, I was reluctant to buy from another company because I wanted all 3 cameras on 1 single app

Problem:
The eBay seller failed to unbind the camera and naturally, he/she is a bit heasitant to part with their password, either because they have genuingly forgotten the password or they dont wish to, and who can blame them, sharing passwords are a security risk. However, equally its a security risk for myself, given the eBayer will know my address to send me the camera, and when connected via a wired connection to the router, nothing could stop the seller (if they were devious) to spy on conversations, view the contents of the room etc, which means I only connect the camera to the network whilst I am working on the fix, and disconnect it any other time until the problem is fixed

Now I appreciate this is the HIKVISION thread, but I have since discovered the Annke model is a HIKVision camera with another brand slapped on the cover, which is why I posted here.

Steps Already taken:

  1. Powered camera
  2. Provided RJ45 wired connection to modem
  3. MIPC / MyAnnke app does not recognise the QR Code, device manual states to download Annke Vision app
    [Well that was disappointing because that was the whole purpose of purchasing another Annke Camera]
  4. Downloaded and Installed the Annke Vision App
  5. Created a new account for it
  6. Scanned QR code - Message appears on screen that the device is already bound, use the unbind button
  7. Unbind is tapped.... and it asks for the original username and password and to enter a captcha code

    Problem: I dont know what the original password was and rolls eyes that the eBay seller didnt clear the credentials first

  8. I then, looked at how I can perform a hard reset, given that unlike the SP1 cameras the reset button is not visible
    I found the following link on the Annke website


  9. I followed the steps and got the "Hello" message, which according to the website is a succesful factory reset

  10. I repeated steps 6 and got the same results

  11. I googled what the default password may be, given that its supposed to be factory reset now, apparently it is blank - nothing
  12. I tried the password as blank, and the Annke Vision app stated no password was entered, so a blank password cannot be used, I tried "Admin", "1234" nothing no joy, no success

  13. I youtubed how to reset a Annke camera when a factory reset is not working and came across the SDAP tool both on the Annke website and Hikvision
    with more links appearing about HIKVISION

  14. So I tried downloading the app and tried it out
    The camera appears on the list in SDAP Tool, I try the unbind button with no joy, as it gives me the same as the mobile phone app
  15. I tried the forgotten password link, I need to send an XML file to Annke.... god thats too long is there a way around this?
    Turns out yes there is, its on this website, get the model and start up date and entered it on this page


    so I tried it, got the code, entered it and got the following message....

  16. Password Reset Failed, Device Denied (or words to that effect, but device denied was definately the ending)

  17. I contact Annke, they tell me to try steps 14-16 again or sent them a photo of the camera base if the above fails
  18. I send Annke a picture of the camera base, they ask me to do the hard reset and send me a link to this, as if I was unable to use google or something!
  19. I replied back I have tried this with no joy, hense me sending them the photo of the base
  20. They replied asking me to try the the Annke Vision app with a new account to unbind, so like a fool, I try that again, wondering if they have done something their end to unbind the device
    This is given that when I tried, I deliberately, uninstalled Annke Vision App, Reinstalled it, and tried a new account as instructed and this time, I did not connect the camera to the network, just to see what would happen, and the app was able to report the camera is bound, meaning the app must be connecting to a central server and report back to the app to state it is bound to another account, makes sense as that's how the app would know there is 2 or more IP cameras linked to your account even when your on another network out and about.
  21. I reconnected the camera, tried another reset
  22. Tried connecting the laptop to a wired connection (RJ45) so that the SDAP tool is on a wired connection and the laptops WIFI/Wireless disabled.
    NO JOY!!!

  23. I also downloaded an applet on Windows "Hikvision Password Reset Tool 1.0.0.1", when the get users button was pressed the message returned was along the lines that the server refused connection as unauthorised.
At this point I have written back to the ebayer, to state I may need to return the item and ask for a refund.

Does any one else have any solutions, would a firmware re-flash work and if so where can I get hold of the flash files and the methods to transport the flash file to the camera ie via TFFT card or USB
Is there another application that allows to extract the settings so that we can decrypt the password or forcefully set it back to INACTIVE state?

I am at this stage giving up the will to live with this camera, and hoping some one with more experience may be able to solve this for me.

I am a software developer and consider my self technically minded, but this is driving me up the wall,more so because ANNKE appear to be incompetent or just getting translations from English to Chinese mixec up.

Thanks in advanced guys
Really appreciated it

PS if there is a way to link IPC cameras up with Hikvision on 1 app can you let me know,as that was the original purpose of getting another Annke camera
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
The camera appears on the list in SDAP Tool
What version of firmware does SADP show for the camera?
What does it show for 'Status' and has this varied with what you've done to the camera?
A long shot as it's probably too new to use the backdoor vulnerability.

Does any one else have any solutions, would a firmware re-flash work and if so where can I get hold of the flash files and the methods to transport the flash file to the camera ie via TFFT card or USB
That would generally reset the camera to default values.
This is the Hikvision tftp updater tool :

By the way - it's not a standard tftp server.
 

saniaowner

Young grasshopper
Joined
Sep 17, 2019
Messages
61
Reaction score
20
Location
World
Hello
You did not start communication with this company correctly.
Go into the SADP program, export the XML file, save it on your computer.
Then you write the letter of the following tipun Annke support mail:
"Hi
I use your IP camera and forgot the password for it. Please help me reset my password, XML file in the attachment"

You attach an XML file to the letter, leave the camera alone (do not turn it off) and go about your own business. Within 4-5 hours you will receive an answer with an XML file. Using the SADP program, import the xml file and create a new password
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
I then, looked at how I can perform a hard reset, given that unlike the SP1 cameras the reset button is not visible
So you did actually find a reset button?

I followed the steps and got the "Hello" message, which according to the website is a succesful factory reset
I have since discovered the Annke model is a HIKVision camera with another brand slapped on the cover,
On the assumption this really is a Hikvision OEM device -
The very old Hikvision firmware has a default admin password of 12345
The less old firmware has a default password of 123456789abc
The newer firmware resets the camera into an 'Inactive' state as seen by SADP. Which requires that you create your own strong password to 'Activate' it.
 
Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Hi AlastairStevenson

Thanks for your reply, here are the answers to your questions

What version of firmware does SADP show for the camera?
V5.4.1build 170321

What does it show for 'Status' and has this varied with what you've done to the camera?
Not sure I follow when you mean by "this varied with what you've done to the camera"
Each time i checked on SADP it has always said "active"

A long shot as it's probably too new to use the backdoor vulnerability.
Ok Thanks

So you did actually find a reset button?
Yes, I believe so, you have to roll the camera up, there is a TFFT cover, inside there a little plastic that you can press, i believe a small button is behind it to cause the device to be reset, it does change the LED from blue to red when pressed for 10 seconds, once released you get the "Hello" message and if its just tapped, it tries doing a WPS connection

The very old Hikvision firmware has a default admin password of 12345
The less old firmware has a default password of 123456789abc

I have tried the above with SADP tool unbind button, nothing says wrong username or password [Note I was on a wifi connection this time]

What version of firmware does SADP show for the camera?
What does it show for 'Status' and has this varied with what you've done to the camera?
A long shot as it's probably too new to use the backdoor vulnerability.


That would generally reset the camera to default values.
This is the Hikvision tftp updater tool :

By the way - it's not a standard tftp server.

So you did actually find a reset button?

On the assumption this really is a Hikvision OEM device -
The very old Hikvision firmware has a default admin password of 12345
The less old firmware has a default password of 123456789abc
The newer firmware resets the camera into an 'Inactive' state as seen by SADP. Which requires that you create your own strong password to 'Activate' it.
 
Last edited:
Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Hello
You did not start communication with this company correctly.
Go into the SADP program, export the XML file, save it on your computer.
Then you write the letter of the following tipun Annke support mail:
"Hi
I use your IP camera and forgot the password for it. Please help me reset my password, XML file in the attachment"

You attach an XML file to the letter, leave the camera alone (do not turn it off) and go about your own business. Within 4-5 hours you will receive an answer with an XML file. Using the SADP program, import the xml file and create a new password
I have emailed last night support@annke.com the xml file and hikvision india (Why India?, something i saw on a youtube video and just on the off chance the same works) with Corona Virus lockdowns around the world, im not counting on normal working hours.

Sorry I forgot to add that to the list of steps taken
 
Last edited:
Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Extracted SDAP Tool information:

IndexDevice TypeStatusIPv4 AddressPortEnhanced SDK Service PortSoftware VersionIPv4 GatewayHTTP PortDevice Serial NumberSubnet MaskMAC AddressEncoding Channel(s)DSP VersionStart TimeIPv6 AddressIPv6 GateWayIPv6 Prefix LengthSupport IPv6IPv6 ModifiableSupport DHCPIPv4 DHCP StatusSupport Hik-ConnectHik-Connect Status
1​
I21AFActive192.168.0.15
8000​
N/AV5.4.1build 170321192.168.0.1
80​
I21AF20170503AAWR749075226255.255.255.018-68-cb-47-1d-cc
0​
V1.0 build 160630
03/05/2020 06:49​
::::
64​
YesYesYesONN/AN/A

Camera is most definately a HIKVision OEM - Verified the MAC Address

1588555518224.png
 
Last edited:

saniaowner

Young grasshopper
Joined
Sep 17, 2019
Messages
61
Reaction score
20
Location
World
This firmware version must have a vulnerability. Try this manual
Step1.
Go to the following IP address in your browser
http://camera_ip/System/configurationFile?auth=YWRtaW46MTEK
Where, camera_ip - IP address of the camera. You can find out IP using the SADP program
If you are lucky, then the configurationFile is downloaded, it has no extension


If you can download the file, send it here
 
Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Whats the username and password

1588533248624.png

This firmware version must have a vulnerability. Try this manual
Step1.
Go to the following IP address in your browser
http://camera_ip/System/configurationFile?auth=YWRtaW46MTEK
Where, camera_ip - IP address of the camera. You can find out IP using the SADP program
If you are lucky, then the configurationFile is downloaded, it has no extension


If you can download the file, send it here
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
So you did actually find a reset button?
Yes, I believe so, you have to roll the camera up, there is a TFFT cover, inside there a little plastic that you can press, i believe a small button is behind it to cause the device to be reset, it does change the LED from blue to red when pressed for 10 seconds, once released you get the "Hello" message and if its just tapped, it tries doing a WPS connection
Well, that's quite promising.
Normally you'd have to have the reset button pressed from before the camera is powered on and keep it pressed for around 30 seconds to reset to defaults.
As opposed to just resetting it.

Maybe also try admin and 123456 and adminABCDEF for the admin password if these haven't been tried already.
 
Joined
May 3, 2020
Messages
6
Reaction score
0
Location
UK
Progress is being made!

OK, so whats the update...

Annke technical support called me, doing a RDP via teamviewer
They were able to reset the password to the camera it's self using SDAP and sending the encryption file.

However, they were unable to unbind the camera from the previous account, stating it has to be done in the same region.
Annke technical support are having to discuss this matter with the senior engineers to have the data on their databases updated,

It does however mean that for the interim,I have been able to log in via the camera internal IP address, set up the recording and access the recordings.
Naturally once the camera is unbound, it can be linked to an account and app

I am considering a set of external cameras with a DVR and pan control
 

Hugenote

n3wb
Joined
Apr 11, 2021
Messages
1
Reaction score
1
Location
germany
Normally you'd have to have the reset button pressed from before the camera is powered on and keep it pressed for around 30 seconds to reset to defaults.
As opposed to just resetting it.
On a LevelOne-IP-Camera FCS-3086 this was the only working reset. After 30 second the relais make a click an then after a short time a become the configuration-site from the camera in the browser and the ask for a new password. And now it works.

Thanks
 
Top