Zero-click RCE vulnerability in Hikvision security cameras could lead to network compromise

guest · Sep 20, 2021

Zero-click RCE vulnerability in Hikvision security cameras could lead to network compromise
Abuse of flaw could give attackers greater access to devices even than its owner
September 20, 2021
https://portswigger.net/daily-swig/...rity-cameras-could-lead-to-network-compromise

A zero-click vulnerability in a popular IoT security camera could allow an unauthenticated attacker to gain full access to the device and possibly internal networks, a researcher has warned.

The researcher, dubbed ‘Watchful IP’, has released details of the unauthenticated remote code execution (RCE) bug in certain products from Hikvision, a Chinese manufacturer and world’s biggest network camera brand.
Click to expand...

In a blog post, they described how the security vulnerability, tracked as CVE-2021-36260, could enable a malicious actor to completely takeover an internet-connected camera and potentially internal networks.

The critical bug – awarded 9.8 on the CVSS scale of severity – enables the actor to gain “far more access than even the owner of the device has as they are restricted to a limited ‘protected shell’ (psh) which filters input to a predefined set of limited, mostly informational commands”, Watchful IP explained.

“In addition to complete compromise of the IP camera, internal networks can then be accessed and attacked.
They added: “Given the deployment of these cameras at sensitive sites potentially even critical infrastructure is at risk.”
Click to expand...

Unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260)

The majority of the recent camera product ranges of Hikvision cameras are susceptible to a critical remote unauthenticated code execution vulnerability even with latest firmware (as of 21 June 2021). Some older models are affected also as far back as at least 2016. Some NVRs are also affected, though this is less widespread.
This is being tracked as CVE-2021-36260

Hikvision’s security advisory: security-notification-command-injection-vulnerability-in-some-hikvision-products
Click to expand...

ronjor · Sep 28, 2021

RCE Vulnerability in Hikvision Cameras (CVE-2021-36260)

Original release date: September 28, 2021
Hikvision has released updates to mitigate a command injection vulnerability—CVE-2021-36260—in Hikvision cameras that use a web server service. A remote attacker could exploit this vulnerability to take control of an affected device.
CISA encourages users and administrators to review Hikvision’s Security Advisory HSRC-202109-01 and apply the latest firmware updates. See security researcher Watchful IP’s technical blogpost for more information
Click to expand...

.

guest · Aug 22, 2022

Over 80,000 exploitable Hikvision cameras exposed online
August 22, 2022

Security researchers have discovered over 80,000 Hikvision cameras vulnerable to a critical command injection flaw that's easily exploitable via specially crafted messages sent to the vulnerable web server.

The flaw is tracked as CVE-2021-36260 and was addressed by Hikvision via a firmware update in September 2021.
However, according to a whitepaper published by CYFIRMA, tens of thousands of systems used by 2,300 organizations across 100 countries have still not applied the security update.
Click to expand...

There have been two known public exploits for CVE-2021-36260, one published in October 2021 and the second in February 2022, so threat actors of all skill levels can search for and exploit vulnerable cameras.
Vulnerable and exploited
CYFIRMA says Russian-speaking hacking forums often sell network entrance points relying on exploitable Hikvision cameras that can be used either for "botnetting" or lateral movement.

Of an analyzed sample of 285,000 internet-facing Hikvision web servers, the cybersecurity firm found roughly 80,000 still vulnerable to exploitation.
Click to expand...

An example they give is a cyberespionage campaign named "think pocket," which has been targeting a popular connectivity product used in an array of industries across the globe since August 2021.

"From an External Threat Landscape Management (ETLM) analogy, cybercriminals from countries that may not have a cordial relation with other nations could use the vulnerable Hikvision camera products to launch a geopolitically motivated cyber warfare," explains CYFIRMA in the whitepaper.
Bleeping Computer has spotted multiple offerings of lists, some even free, containing credentials for Hikvision camera live video feeds on clearnet hacking forums.
Click to expand...

If you operate a Hikvision camera, you should make it a priority to install the latest available firmware update, use a strong password, and isolate the IoT network from critical assets using a firewall or VLAN.
Click to expand...

Log in or Sign up

Zero-click RCE vulnerability in Hikvision security cameras could lead to network compromise

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Zero-click RCE vulnerability in Hikvision security cameras could lead to network compromise

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches