Hikvision Linux Client Vulnerability: A Critical Issue

In March 2017, Hikvision released a firmware fix to address a critical vulnerability in its IP cameras. However, despite this patch, a significant number of devices remain vulnerable, with over 60% of Hikvision cameras still at risk, according to IPVM statistics.

The severity of this issue is further underscored by the simplicity with which these devices can be compromised. With just one simple HTTP call, hundreds of thousands of connected devices can be rendered permanently unusable. This is due to a backdoor that allows unauthenticated impersonation of any configured user account, granting an attacker complete control over the device.

The vulnerability is particularly concerning because it allows attackers to download camera configuration files, obtain snapshots of the camera, and even flash arbitrary code or firmware updates without authentication. Moreover, all other HikCGI calls can be impersonated in a similar manner, including those that add new users or update firmware.

Incredibly, this exploit requires only appending a specific string to Hikvision camera commands. The researcher responsible for the discovery explained the simplicity of the exploit in their disclosure, stating that it was as simple as adding this string to a command: 'Retrieve a list of all users and their roles.'

The implications of this vulnerability are far-reaching, with potentially catastrophic consequences if exploited by malicious actors. IPVM has set up a vulnerable Hikvision IP camera for members to test and better understand the exploit.

Unfortunately, Hikvision has been silent on the issue, failing to inform and warn its dealers of the new disclosure. This lack of transparency has led many dealers to underestimate the severity of the backdoor, which is still present in a clear majority of Hikvision IP cameras.

The exploit has already been repurposed as a tool and distributed online, further highlighting the need for prompt action from Hikvision to address this critical issue.

* The vulnerability affects over 60% of Hikvision cameras.

* The exploit is incredibly simple, requiring only appending a specific string to camera commands.

* The backdoor allows unauthenticated impersonation of any configured user account.

* IPVM has set up a vulnerable Hikvision IP camera for members to test and better understand the exploit.

* Hikvision has been silent on the issue, failing to inform and warn its dealers of the new disclosure.

In conclusion, the Hikvision Linux client vulnerability is a critical issue that demands immediate attention from device manufacturers and users. The simplicity and fundamental nature of the backdoor make it an attractive target for malicious actors, and prompt action is necessary to prevent widespread exploitation.

Hikvision linux client