Wrongly Accused Critical Vulnerability for Vivotek

Author: Brian Karas, Published on Jul 13, 2017

Vulnerabilities are an increasing branding and business problem for video surveillance manufacturers. However, sometimes vulnerabilities reported are not as critical as the reports claim.

Vivotek was recently faced with one but the vulnerability was meaningfully overstated. IPVM discussed this with the researcher who initially reported them and Vivotek, providing a more accurate assessment of the risks inside this report.

*************** *** ** ********** ******** *** ******** ******* *** ***** surveillance *************. *******, ********* *************** ******** *** *** ** ******** as *** ******* *****.

******* *** ******** ***** **** *** *** *** ************* *** meaningfully **********. **** ********* **** **** *** ********** *** ********* reported **** *** *******, ********* * **** ******** ********** ** the ***** ****** **** ******.

[***************]

Vulnerability *******

***-****-****** ****** ** * ******** ***** ** **.*, *** ********* a ************* ** * *** ****** **** *** ** ********* to ***** ** *************** ******** (*********) ** ******* ***** ******** as ****.***-****-****** ****** ** * *.*, *** ********* * ************* ** a ******** *** ****** **** *** ** ********* ** ***** an *************** ******** ** **** *** **** ** *** ******, including ****** ***** **** ** *** ******** ********.

Original ********** ** ******* **********

******* **, * ******** ********** ** ***** *** **** **** ** "Cursered" *** "************"********* ******* ** *** ******** ** **** ****. ** ********* *********** *** ********** * ******* ******** ***** for ********, *** ******** **** ***** ******** *** ********** **** of ***** ***************.

NOT ********* ** *************** *****

***** *** ***'* ***** **** *** *************** ** *** ******* a ***** ** *******, **** ******* *** *** ********** ********* the ************* *** *********** **** * ***************, ****** *** **** ************ *** *** ****** ** ***** remote ****** **** ** ***** ********.

Admin-Level ****** ********

*** *************** ******** ******* ** *** *** ********* **** *** administration *****, *** ** * ******** ********** *** **** ********** to ***** **** ** *****-***** *****. ***** ***** *** ********* the ******* *** *************** ******, ******* ************ ********** ******* ***** this.

************* *** ***'* ** ******* *** *********** ** **** ******* access ** *** ****** ***** *** ******* ***** ** *, and ***** *** ************** ***** *** **** **** ** ** 8. ***** ***** *********** **** ** ******* ******* ***********, *** vulnerabilities ****** **** **** ****** ** ** ********* ** ****-***** scenarios.

Default ** ********

*** *******, ********* *** ************ ** **** *****, ** **** Vivotek ******** ** ** ********, ******** *** **** ** ****** the ****** ****** * ******** ** ***********. **** ** * security **** ** ******.

*******'* ******** ********* ************** *** **** ******** ** *** ***** **** ***** ********* firmware, ************ ***** *** * ****** ********, *** ******* ** the ***** ** ***** **** ** ** *********. ***** *** follow *******'* ***** *** ******* **** ********* ***** ************* ****** the ******* ** ***** *************** ***** *********. *******, ******* ***** improve *** ******** ** ******* ****** ********* ** *******.

Vivotek ******* ** ******* ********

******* ****** **** **** **** ***** ** **** ************* **** first *********, *** **** **** ******* ** ******** ******* ** resolve **. ********** ****** ** ************, ********** ** **** ******** ******* ********* ** **** **, 2017.

OEM/ODM ****** *** ********

******* **** ******** ***/*** ******** *** **** ********* ** *** industry. ********* ** *******, ** **** ***** ***** ******** *** firmware ********* ** *** ******* ***'*** *** *******, *** **** those ******** ***** *** **** *******'* *******, *** ********** ***************.

Few ******** ********** *******

* ****** ***** ******** ********** *** ********-********** ******* *******, *** many ** ***** ******** ** ************** *****, ********** **** *** specified ** ***** **** ***** ** **** ********.

Risk ********-***

*******, ***** *************** **** * ********** *** ****, ************ ******* their ****** ***** *** ** ************* ******* **** ** ******* a ****** ***** ********, ********* ********* ***** *** ******* **, if **** **** *** *******. *******, ******* **** ** ***** the ********* *** ********* ** *** ****** ** ******** ***** on *** ******, ** ******** **** *** ****** **** * botnet ******, ****** ** ******* ******* ****** ****** **** *** not ******* **** ********* *****, ** ***** **** *********.

Comments (0)

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Hacking

PR Campaign Exploiting Manufacturer Cybersecurity on Jul 20, 2017
Manufacturers increasingly have a bulls-eye on their back. As cyber security solutions providers grow, they realize a great way to get publicity...
Hikvision USA Head of Cybersecurity Exits on Jul 18, 2017
Hikvision USA's Head of Cybersecurity has exited the company. In this note, we review the move, share Hikvision's feedback and examine the...
ONVIF Chairman Criticizes Low Cost Cameras (Also, He Works At Axis) on Jul 12, 2017
ONVIF Chairman Per Björkdahl has taken a strong public stance against low cost cameras that are 'much more vulnerable to attack' as he explains in...
Smartcard Copier Tested (13.56MHz) on Jul 05, 2017
Copying 125kHz cards is certainly easy, as our test results showed, but how about 13.56MHz smart cards? Are they more secure? IPVM focused on the...
No Hack, Still Liable, Court Finds ADT on Jun 20, 2017
Recently, ADT has been in the news for a $16 million settlement for a cyber security vulnerability class action suit. One of the most important...
How To Hack Your Company's Hikvision Recorder on May 29, 2017
Here's how easy it is to hack your company's Hikvision recorder: It does not matter how hard or secret the admin password is. Hikvision will...
Anti-Hack Access Card Shields Tested on May 26, 2017
Keeping your access control card information secure is becoming a big priority, especially since cheaper copiers can hack details easily. Multiple...
Axis Criticizes OEMs: "When You Buy An Axis Camera, An Axis Camera Is What You Get!" on May 19, 2017
When you buy a Honeywell camera, you likely get a Hikvision, Dahua or some other company's product. The same goes for easily 100 different...
Hackable 125kHz Access Control Migration Guide on May 19, 2017
Despite being one of the most popular credentials, 125 kHz credentials are easily copied and insecure as we showed in our test results, video...

Most Recent Industry Reports

Axis Door Station Tested (A8105-E) on Jul 19, 2017
Axis continues their push into niche markets, especially audio, with network speakers, an IP horn, and video door stations. We tested Axis'...
Manufacturer Favorability Guide on Jul 19, 2017
This 120 page PDF guide may be downloaded inside by all IPVM members. It covers our 20 manufacturer favorability rankings and 20 manufacturer...
$8 Billion Utility Georgia Power Enters Surveillance Business Offering Avigilon And Genetec on Jul 19, 2017
Utilities are typically considered major customers of surveillance integrators but one utility, Georgia Power, with $8+ billion in annual revenue...
Knightscope Laughs off Robot Drowning on Jul 18, 2017
A day after a Knightscope robot drowned, Knightscope has issued an 'official statement' making fun of the issue: The implied message is that...
Microsoft Video AI Cloud Services Examined on Jul 18, 2017
Microsoft has released one of the most amazing video analytics marketing videos ever. In it, they detect oil spills, track individual people giving...
Hikvision USA Head of Cybersecurity Exits on Jul 18, 2017
Hikvision USA's Head of Cybersecurity has exited the company. In this note, we review the move, share Hikvision's feedback and examine the...
'Suicidal' Knightscope Robot Drowns on Jul 17, 2017
Knightscope continues its hyper growth, at least when it comes to controversy, this time with a 'suicidal' robot in Washington DC. And here is...
March Networks Company Profile on Jul 17, 2017
March Networks was one of the most well-known video surveillance manufacturers of the 2000s. In 2012, March was acquired by Chinese / American...
Milestone Beats OnSSI In Court on Jul 17, 2017
The litigation between former partners Milestone and OnSSI has finished, confirmed by both parties. In April 2016, OnSSI sued Milestone and in...
Power For Burglar Alarms on Jul 14, 2017
In order to operate, alarm panels require the high voltages found in electrical outlets be converted to the low voltages they run on. In this...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact