Hikvision DS-2CD2012-I XML Injection / Abuse Issues

`Hello list!  
  
There are vulnerabilities in Hikvision DS-2CD2012-I.  
  
These are XML Injection, Abuse of Functionality and Brute Force   
vulnerabilities. All these vulnerabilities are present in other IP cameras   
and DVR of Hikvision.  
  
-------------------------  
Affected vendors:  
-------------------------  
  
Hikvision  
http://www.hikvision.com  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are the next models with different versions of firmware:   
Hikvision DS-2CD2012-I and other IPC, DVR and NVR of Hikvision, the list of   
models I wrote earlier (http://seclists.org/fulldisclosure/2015/Mar/161).  
  
As Hikvision answered me at 01.03.2015, they didn't want to fix Abuse of   
Functionality vulnerability, but they will fix Brute Force vulnerability in   
firmware in the beginning of this year. And they fixed XML Injection   
vulnerability last year.  
  
Hikvision fixed XML Injection in firmware for DVR/NVR in V3.2.0 and for IPC   
in V5.2.0 and fixed Brute Force in the last firmware.  
  
----------  
Details:  
----------  
  
XML Injection (WASC-23):  
  
http://site/ISAPI/%3C/requestURL%3E%3Clink%3Ehttp://site%3C/link%3E%3CrequestURL%3E/  
  
It can be used for XML Injection and XSS attacks.  
  
Abuse of Functionality (WASC-42):  
  
Login is persistent: admin (only logins for users can be changed). Which   
simplify Brute Force attack.  
  
Brute Force (WASC-11):  
  
In login form http://site/doc/page/login.asp there is no protection against   
Brute Force attacks. Which allows to pick up password (if it was changed   
from default).  
  
I found this and other web cameras during summer to watch terrorists   
activities in Donetsk and Lugansks regions of Ukraine and also I took under   
control web cameras in Russia   
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2015-April/009090.html).  
  
I mentioned about these vulnerabilities at my site   
(http://websecurity.com.ua/7346/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
`