Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260)

Hikvision’s security advisory: security-notification-command-injection-vulnerability-in-some-hikvision-products

This permits an attacker to gain full control of the device with an unrestricted root shell, which is far more access than even the owner of the device has as they are restricted to a limited “protected shell” (psh) which filters the input to a predefined set of limited, mostly informational commands.

In addition to complete compromise of the IP camera, internal networks can then be accessed and attacked.

Risk Assessment

Impact:

• Remotely Exploitable: Yes

• Authentication Required: None

• Zero clicks (no action needed from device owner): Yes

• Render device inoperable: Yes

• Read customer data: Yes

• Change customer data: Yes

• Latest firmware vulnerable: Yes (as of 21 June 2021)

• Latest products vulnerable: Yes

• Denial of Service vulnerability: Yes

• Potentially enable a physical attack on site: Yes

• Attack internal network: Yes

Vulnerability Details

Not for public release to protect companies/end users.

Proof of Concept (POC) example

Hikvision HSRC (Hikvision Security Response Center) requested POC of the vulnerability when I first reported it to them, and I replied with working code within 2 hours or so. As it’s not responsible to disclose a POC, I instead decided to make a video showing it in action, though I have subsequently agreed with Hikvision not to release it. 

Rather than just use my own equipment as a target, which could seem contrived, I enlisted the aid of a friend from the http://ipcamtalk.com forum, who kindly put up a real live camera with permission to exploit. I wasn’t told the access credentials but during the attack, it was clear it’s running 2021 firmware, and the camera was manufactured in January 2021.

The video showed a real-world example of me attacking this target, obtaining information that should be only available to the owner, obtaining a root shell accessible via SSH (even though SSH disabled in the web interface), and ultimately bypassing the camera admin web portal authentication.

A few stills from the real target POC video

With a root shell, a real attacker could have easily taken a large range of hostile actions at this point.

Recommendations made to Hikvision:-

I made several recommendations in my report to HSRC. I identified the flawed code that was the problem and indicated how I thought it best to remedy it. I don’t have access to their codebase repositories, but rather needed to decrypt firmware, and reverse engineer code yet I still found it. Issue new firmware as soon as possible and issue a public security advisory.

Remediation

Is this a Chinese Government-mandated Backdoor?

No, definitely NOT. You wouldn’t do it like this. And not all firmware types are affected.

Additional

Thank you to Hikvision - particularly the Head of HSRC, his team, and R&D for working hard to fix this quickly. I sent them lots of emails and reports which they kindly liaised with me on.

Affected Firmware Types

Affected Model List

Coming up with a proper affected model list is hard:

• Chinese region variants have often had their own model names.

• Some firmware does not have public release notes that list the compatible models

• There’s a huge number of OEM resellers with their own model numbers

Timeline

• Wednesday 23 June 04:27 received a reply from HSRC@hikvision.com requesting a report on my findings.

• Wednesday 23 June 05:40 v1.0.0 of vulnerability details (WIP-2021-06-HIK-2) emailed to HSRC@hikvision.com