CVE-2024-29948

There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

CVE-2023-28811

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network LAN could cause the device to malfunction by sending specially crafted packets to an unpatched device...

CVE-2023-6895

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK. It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondataip with the input netstat -ano leads to os command injection...

CVE-2023-6893

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input...

CVE-2023-6894

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK. It has been classified as problematic. This affects an unknown part of the file access/html/system.html of the component Log File Handler. The manipulation leads to information disclosure. The exploit has...

CVE-2021-36260

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2013-4975

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

CVE-2024-29949

There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands...

Logic Flaw Vulnerability in DS-A80624S at Hangzhou Hikvision Digital Technology Co.

The DS-A80624S is a 24-drive network storage device from Hikvision. A logic flaw vulnerability exists in the DS-A80624S of Hangzhou Hikvision Digital Technology Co. that can be exploited by an attacker to obtain sensitive information...

CVE-2024-12569

Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions...

CVE-2024-12569 Sensitive Information in Driver’s Log File

Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions...

CVE-2024-12569 Sensitive Information in Driver’s Log File

Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions...

CVE-2024-12569

CVE-2024-12569 describes an information-disclosure in the Milestone XProtect Device Pack driver’s log files, allowing a local attacker to read camera credentials stored in the Recording Server under certain conditions. The vulnerability affects the Milestone XProtect Device Pack camera drivers an...

PT-2024-17657 · Hikvision +1 · Hikvision Camera Driver +1

Name of the Vulnerable Software and Affected Versions: Milestone XProtect Device Pack affected versions not specified HikVision camera driver in XProtect Device Pack affected versions not specified Description: The issue is related to the disclosure of sensitive information in a log file of the...

The vulnerability of the HTTP protocol implementation in DynDNS and NO-IP microprogramming-based IP camera software from Hikvision allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the HTTP protocol implementation in DynDNS and NO-IP microprogramming-based IP camera software from Hikvision involves the transmission of confidential information in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to carry out a...

Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials

Overview Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP.The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware...

PT-2024-41474 · Hikvision · Ds-2Cd1Xxxg0 +11

Уязвимость реализации протокола HTTP служб DynDNS и NO-IP микропрограммного обеспечения IP-камер Hikvision связана с передачей конфиденциальной информации в незашифрованном виде. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить атаку типа «человек посередине»...