Metasploit modules that can be used to exploit Hikvision products

Order by Disclosure Date Module Name Module Type
  • Hikvision IP Camera Unauthenticated Command Injection
    Disclosure Date: 2021-09-18
    First seen: 2022-12-23
    exploit/linux/http/hikvision_cve_2021_36260_blind
    This module exploits an unauthenticated command injection in a variety of Hikvision IP cameras (CVE-2021-36260). The module inserts a command into an XML payload used with an HTTP PUT request sent to the `/SDK/webLanguage` endpoint, resulting in command execution as the `root` user. This module specifically attempts to exploit the blind variant of the attack. The module was successfully tested against an HWI-B120-D/W using firmware V5.5.101 build 200408. It was also tested against an unaffected DS-2CD2142FWD-I using firmware V5.5.0 build 170725. Please see the Hikvision advisory for a full list of affected products. Authors: - Watchful_IP - bashis - jbaines-r7
  • Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a
    Disclosure Date: 2017-09-23
    First seen: 2022-12-23
    auxiliary/gather/hikvision_info_disclosure_cve_2017_7921
    Many Hikvision IP cameras have improper authorization logic that allows unauthenticated information disclosure of camera information, such as detailed hardware and software configuration, user credentials, and camera snapshots. The vulnerability has been present in Hikvision products since 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names. Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing (shodan search: "App-webs" "200 OK"). This module allows the attacker to retrieve this information without any authentication. The information is stored in loot for future use. Authors: - Monte Crypto - h00die-gr3y <h00die.gr3y@gmail.com>
  • Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic
    Disclosure Date: 2017-09-23
    First seen: 2022-12-23
    auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921
    Many Hikvision IP cameras contain improper authentication logic which allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names. Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing (shodan search: '"App-webs" "200 OK"'). Some of these devices can never be patched due to to the vendor preventing users from upgrading the installed firmware on the affected device. This module utilizes the bug in the authentication logic to perform an unauthenticated password change of any user account on a vulnerable Hikvision IP Camera. This can then be utilized to gain full administrative access to the affected device. Authors: - Monte Crypto - h00die-gr3y <h00die.gr3y@gmail.com>
  • Hikvision DVR RTSP Request Remote Code Execution
    Disclosure Date: 2014-11-19
    First seen: 2020-04-26
    exploit/linux/misc/hikvision_rtsp_bof
    This module exploits a buffer overflow in the RTSP request parsing code of Hikvision DVR appliances. The Hikvision DVR devices record video feeds of surveillance cameras and offer remote administration and playback of recorded footage. The vulnerability is present in several models / firmware versions but due to the available test device this module only supports the DS-7204 model. Authors: - Mark Schloesser <mark_schloesser@rapid7.com>
4 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close