Hikvision VMS Password Recovery Vulnerability - Emailing Admin Passwords In Plain Text

Author: Michael Budalich, Published on Aug 28, 2017

Hikvision iVMS-4200 suffers from a vulnerability that allows anyone local, without authentication, to generate a code that Hikvision will respond by emailing the admin password in plain text.

This is different than the Hikvision recorder cracked security codes. Because it is for the iVMS-4200, exploiting this vulnerability would provide access to all devices connected to the iVMS-4200 including Hikvision cameras and recorders, as well as any 3rd party cameras connected through those recorders.

In this report we detail the vulnerability, explaining how it can be exploited and the security problems therein.

********* ****-**** ******* **** * ************* **** ****** ****** *****, without **************, ** ******** * **** **** ********* **** ******* by ******** *** ***** ******** ** ***** ****.

**** ** ********* **** ************ ******** ******* ******** *****. ******* ** ** *** *** ****-****, ********** **** ************* would ******* ****** ** *** ******* ********* ** *** ****-**** including ********* ******* *** *********, ** **** ** *** *** party ******* ********* ******* ***** *********.

** **** ****** ** ****** *** *************, ********** *** ** can ** ********* *** *** ******** ******** *******.

[***************]

iVMS-4200 ******** *************

*** ****-**** ****** ******** * "****** ********" ******:

******** "****** ********" ******* ** "********* ******",***** *** ** ******* ** ********* ******* *** ******** ********:

****** ** **** ** '******* **** ******', ********* ******* ******* admin ********* ** ** ******* *** ******* ** ************** ** verification.

***** * ***** ****** (~** ******* ** *** *******), ********* support ****** *** ****-**** ******'* ***** ******** ** ***** ****:

Multiple ******** *****

***** *** * *** ******** *****:

  • ** ************** *** ************
  • *** ****'* ******** ** ******* **** ** ***** ****
  • ** ***** ** ******
  • ******* *********
  • *********** ********* *** ** *******

No ************** *** ************

****** *** *** **** ** ** * ******** **** ****-**** software *** *** *** ***** ******** ********. ***** ** ** email, ***** ****** ** *** ***** ******* ** ****** ** authenticate *** ********* ** **********. **** ** ****** *** ****** universally ******* *******.

Plain **** ********

******** *** ******** ** ***** **** ** ******* ********* ** basic ******** *********, **** ***** ***** **** ******** **** *** change ** **** ***. ****** *** *** ****** ** **** email, ****** ** *** ******** ** ******'* **** *** *** the ***** ******** *** *** ******.

No ***** ** ******

**** ******** ******** ******* **** ********* ******* **** **** **** than ******** ******** ******, ** ** ******** *** ****** ***** password ** ** ************ ******. **** ******** ***** *********, *** admin ******** **** ***** ** * *** *****, ******** ******** legitimate ***** **** ********* *** ** ***** **** ***** ******** stops *******.

Reusing *********

***** ******* ********* ****** ******* ** *** ********, ** ** common. ** *** ****** *** ***** *** ****-**** *********** **** the **** ***** ******** ** ***** ******* ** ************, *** attacker *** *** *** ***** ******** ** * ******* ** devices. **** ** *** ****-**** ***** ******** ** ******, ********* the ********* ******** *** ******* ***** **** *** *** **** chooses *********, ****** ** ****** ** **** ************ ****** ** other *******.

Recoverable ********* *** ** *******

*********'* '********* ******' *** *** ******** *** ** *******. ** independent ******** ******* *** **** ** ********* *** ********* ******* about *** ******* ****** * *** *****:

*** ***** ******** ** ********* **** *** ** *** ****, and ** **** ****** *******, ******* ****** "***" *** "***". This ** *********** *** *** **** ** ******* *** ******** upon ******* ***********. *** ** *** **** ** *********** ** a ********* ******** ******, ******** ** ******** ** ********* *** blocksize, ******, *** ******* ****** *** **********. ** * ******, the ******** ***** ** **** ** ********* *** ***/******** **** for ********** *** ***** **** ******* *** **** *********.

** *********'* ******** ********** ****** **** *******, ********* ***** ** revealed ******* *** **** ** ******* ********* *******, ****** ** even ****** *** ****** *** ****-**** ******* ** ** ***********.

Risk ** ********** ** ******** ********* *************

*** ***** ***** ******** ***** ***** *** **** **/****-**** ************, it ** *********** ********** ** ******** ****** *** ******** **** lower-level ***** ********* *** ***** ******** "********* ******" *** ******* it ** ********* ******* ** ******** *** ***** ********.

********* *** ****** ********** **** ********, ****** ** *********** *** larger *************, ********* ***** ********** ** **** ** ********* ********** admin ********* ******* **** *************.

Hikvision

**** ***** ********* ** ********* *** ***** *********/******** **** ****** in * ******* ****** ***** ********* ********* *** ***********, *** there ** * *** *** ***** ** ******* *** ******** recovery ** ****-****. ********* *** *********** ******* ** *** *********, but *** *** ***** * ********, ** ************ **** * response ***** ** ********.

******

***** ********* *** *** ******* ** *** ***** (**** ****** 24th), **** ******** * "******* ********" *** ******* ******* ** iVMS-4200 ***** (****** ****):

Mitigating ******** ******** ****

******* ********* ***** ** ** **** *** ** ************ **** to ******** ** ****-**** ***** ********, ***** ** *** *********** need ** ******* ******* ************ ****** ** *** ***********. ****** savers **** * **** ***** ******** *** ******** ****** *********** should ** **** ** ******* ************ ***** **** ********* *** app *** ********** *** ******** ***** ****.

Hikvsion **** ******** ********

*************** ****** ** "********** *** ********** ** *********** ********", ***** ******* *********** ***** *********. *************** **** **** ***** in*********'* ****** ***,***** ********,*******/*********, *** *** ** ***********. ***** ********** *************** **** **** the ******* **** *** ***** *********** ********/***** ******** ** * top ********, ****** * ********** ******* ** ********* ******** ** managing *********** ********. ** ** ****** ****** **** ***** ******* lines, **** ** ****** ******* ** *********, **** ******* *************** that *** ********* ** ****. ***** ** ********* ******** ** software ****** ******** ***** ******** **********, *** *** *********** ******* to ******* ******* ******** *** ******** ******* *************.

Comments (11)

Undisclosed Integrator #1

08/28/17 05:22pm

(****** ********* ******* ******** ******** *** ***** ****)

Thumbnail brk1

Brian Karas

IPVM | 08/28/17 05:35pm

***** ********* *** *** ******* ** *** ***** (**** ****** 24th), **** ******** * "******* ********" *** ******* ******* ** iVMS-4200 ***** (****** ****):

****-**** ******* ******** ********

Thumbnail brk1

Brian Karas

IPVM | 08/28/17 07:11pm

** ******** ** ******** *** "****** ********" ********, ********* *** stopped ******* ******** ******** ********. * ******* ********* ***** **** report *** ******** ******** *** ********* ******** **** *********:

*** ******** *** *** **** ** ***** **** *** ********/******* was *******, *** *** **** ********* *********** *** ****** ******* with *** "******** ******** *********".

Thumbnail marty2016

Marty Calhoun

IPVMU Certified | 09/03/17 05:40pm

**** *****

********** ***** ********* ***** *** ** ***** *** ******** ********, it ** **** ********* ** *** ***-*******.

Undisclosed #2

In reply to Marty Calhoun | 09/03/17 05:48pm

...** ** **** ********* ** *** ***-*******.

** **** **** * ***?

Thumbnail marty2016

Marty Calhoun

IPVMU Certified | In reply to Undisclosed #2 | 09/04/17 12:00am

** ** * *** ********. *********** ********** ****** *** ** be ******** **** * *** ** ****-****.

** ***** ***** ***** ** **, ***** *** ******* **********, blame *** *****-******** ******** **** *** **** (**) ***** ** Hik, ***** *** ******* **** ** **, ***** ** ********** that *** **** ******** *** *** ****** * ***-******** ********** of *** ******** *** *** ********* ******* *** '******** ** the ****' ********.

John Honovich

IPVM | In reply to Marty Calhoun | 09/03/17 11:54pm

*****,

***-******* *** **** ******** ** *** **** *** ****** ***** means **** *** *********, ********** ** ********* *** ***** ***-*******.

***, **** ******** ************* ******* *** ***-******* **** *** *******?

Undisclosed #2

In reply to John Honovich | 09/04/17 12:14am

********** ***** ********* ***** *** ** ***** *** ******** ********, it ** **** ********* ** *** ***-*******. - *.*.

... **** *** *********, ********** ** ********* *** ***** ***-*******. - *.*.

**** ** ***** ****** ** ****, ****** ********* *** **** few ********** *********.

John Honovich

IPVM | In reply to Undisclosed #2 | 09/04/17 12:28am

***** ** ******** **** ********** ***** ***************** ***** ***-*******.

******* **** ****** *** ***-******* ** ***, ** **** ******* general ************ **** **** * ****** ***:

** *** ******* **, ********** ** **** ***** ********* ****** be *****, ************ *********, ********** ** ***, *** ***** ****-**** since ***-******* ** ***** ***.

** ******, ******* ***-******* ** ****** * *********** ** *** fact **** *********'* **** ************* ****** ******* ******** ***** ********* in ***** ****.

Undisclosed #2

In reply to John Honovich | 09/04/17 12:39am

***** ** ******** **** ********** ***** ***************** ***** ***-*******.

*** ** *** ***** ************ ****.

John Honovich

IPVM | In reply to Marty Calhoun | 09/03/17 11:59pm

**** *****

*** ***** ** ** * '**** *****' ** **** ***** passwords ** ***** **** ** ******?

*****, *** *** ******* ** *** **** *** **** *** these **** ** ********* ********** **** ********* *** ***** ******* are *** ******* ***** ***** ******** *** ****** ** ******** excuses.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on VMS

Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Mysterious Patent Troll 'Secure Cam' Targets Industry, Sues Hanwha, Hikvison, JCI, Panasonic, More on Oct 11, 2018
A company named "Secure Cam," who is actively hiding their ownership, has acquired a slew of video patents and is systematically suing video...
Security System Health Monitoring Usage Statistics 2018 on Oct 09, 2018
How well and quickly do integrators know if devices are offline or broken? New IPVM statistics show that typically no health monitoring is...
IACP 2018 Police Show Final Report on Oct 08, 2018
IPVM went to Orlando to cover the 2018 IACP conference, the country's largest police show (about as big as ASIS), examining the 700+...
VMS Mobile App Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Oct 01, 2018
Mobile VMS apps are a critical interface for the modern surveillance user. But who does it best and worst? We tested 6 manufacturers - Avigilon,...
Hikvision 4MP Camera Tested (DS-2CD2345FWD-I) on Sep 27, 2018
Hikvision's latest Performance Series / EasyIP 3.0 4MP model, the DS-2CD2345FWD-I, was the top performer in our 4MP shootout, besting rivals from...
ASIS GSX 2018 Show Report on Sep 25, 2018
In the first major US show since the US government ban of Dahua and Hikvision was passed into law, the mega Chinese companies were in retreat and...
4MP Camera Shootout - Axis, Dahua, DW, Hanwha, Hikvision, Uniview, Vivotek on Sep 24, 2018
4MP usage continues to climb, especially for low cost fixed lens models. To see who was best, we bought and tested seven 4MP models from Axis,...
VMS Export Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Sep 13, 2018
When crimes, accidents or problems occur, exporting video from one's video surveillance system is critical to proving incidents. But who does it...

Most Recent Industry Reports

Startup SafePass Profile on Oct 19, 2018
A major problem with visitor management is that the systems mostly require adhesive printed paper labels and paper logs, creating waste and an...
China Is Not A Security Megatrend, Says SIA on Oct 19, 2018
The US Security Industry Association has released its 10 "Security Megatrends" for 2019. SIA declares that these megatrends, such as "Advanced...
Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Camera Height / Blind Spot Added to IPVM Camera Calculator on Oct 18, 2018
IPVM has added camera height and blind spot estimation to the Camera Calculator. This is especially helpful for those who need to mount cameras up...
Axis Strong US Growth, Flat EMEA - Q3 2018 Financials on Oct 18, 2018
This spring, Axis had its best financials in many years (see Axis Strong Q2 2018 Results). However, over the summer, Axis had many products sold...
Best Alternatives to Banned Dahua and Hikvision on Oct 17, 2018
With the US government ban and a growing number of users banning Dahua and Hikvision, one key question is what to use for low cost? While Dahua and...
Video Quality / Compression Tutorial on Oct 17, 2018
While CODECs, like H.264, H.265, and MJPEG, get a lot of attention, a camera's 'quality' or compression setting has a big impact on overall...
Knightscope Winning Investors, Struggling With Growth on Oct 16, 2018
While Knightscope's new financials show the company only winning 11 new customers in the past 12 months, the company continues to win new...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Huawei Admits AI "Bubble" on Oct 16, 2018
A fascinating article from the Chinese government's Global Times: Huawei’s AI ambition to reshape industries. While the Global Times talks about...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact