Hikvision 2021 Critical Vulnerability

Hikvision officials have admitted that there’s a zero-click vulnerability in many of their security cameras and NVRs that could allow an unauthenticated attacker to gain full access to the device and possibly internal networks.

The researcher, dubbed ‘Watchful_IP’, has released details of the unauthenticated remote code execution (RCE) bug in certain products from Hikvision that bypasses the device’s username and password.

The vulnerability can be exploited to gain root access and take full control of a device. An attacker could also use compromised devices to access internal networks. “Given the deployment of these cameras at sensitive sites potentially even critical infrastructure is at risk,” the researcher warned.

In total, more than 70 Hikvision camera and NVR models are affected by a critical vulnerability and according to IPVM, more than 100 million devices are impacted.

How the Hikvision 2021 Critical Vulnerability works?

“Watchful_IP”, the researcher, describes it as simple to exploit: Only access to the http(s) server port (typically 80/443) is needed. No username or password needed nor any actions need to be initiated by the camera owner. It will not be detectable by any logging on the camera itself.

The researcher refused to release a full Proof of Concept, but Hikvision describes it as the result of “send[ing] a specially crafted message”. A CVE has been reserved (CVE-2021-36260).

The researcher claims that firmware has been susceptible to the bug since as far back as 2016. Hikvision has acknowledged the findings and has patched the issue. The company has also released a security advisory detailing which products are at risk.

A summary reads: “Due to the insufficient input validation, an attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.”

This vulnerability provides total control of the embedded computer’ in these devices with unrestricted root shell access, according to Watchful-IP:

This permits an attacker to gain full control of a device with an unrestricted root shell, which is far more access than even the owner of the device has as they are restricted to a limited “protected shell” (psh) which filters input to a predefined set of limited, mostly informational commands.

This means as the researcher pointed out, that the vulnerability can be used to “access and attack” internal networks as well as launch denial of service attacks across the Internet.

Are the OEM versions impacted by this vulnerability?

Yes, even the OEM version will be impacted. And because Hikvision cameras are so widespread, the vulnerability will impact hundreds of brands worldwide. Check out the Hikvision OEM directory in this link.

The worst part is that many Hikvision OEM brands try to hide their relationship with Hikvision and pass the cameras as their own, meaning they’ll disregard this vulnerability and many users will not even realize it.

Affected versions and resolved version