HikPwn - A Simple Scanner For Hikvision Devices

HikPwn, a simple scanner for Hikvision devices with basic vulnerability scanning capabilities written in Python 3.8. This project was born out of curiosity while I was capturing and watching network traffic generated by some of Hikvision's software and devices. Setup instructions: git clone...

Exploit for CVE-2014-4878

PoC-and-Exp-of-Vulnerabilities 漏洞验证和利用代码收集 - 免责声明：本项目中的代码为互联网收集或自行编写，请勿用于非法用途，产生的法律责任和本人无关。针对Windows的PoC很多会被杀毒软件拦截，此为正常现象，请自行斟酌是否下载，如果有带有后门的exp，请通过提交issue联系我。 Windows - CVE-2017-0143MS17-010 Microsoft Windows SMB远程代码执行漏洞（永恒之蓝） - CVE-2017-7269 Microsoft IIS 6.0 远程代码执行漏洞 - CVE-2017-11882 Microsoft...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

Design/Logic Flaw

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2020-7057

CVE-2020-7057 affects Hikvision DVR DS-7204HGHI-F1 running V4.0.1 build 180903 web interface. The login endpoint ISAPI/Security/sessionLogin/capabilities returns different responses for failed login attempts based on whether the username exists, enabling user enumeration. The description states o...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

CVE-2013-4975

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

Hardcoded credentials

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

Privilege escalation

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

CVE-2013-4976

CVE-2013-4976 affects Hikvision DS-2CD7153-E IP Cameras, enabling security bypass via hardcoded credentials (remote authentication bypass). The NVD entry lists high/severe impact with CVSS v3.1 base score 9.8 (NETWORK, NONE prerequisites, US S) and CVSS v2 base score 7.5, indicating critical risk...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

CVE-2013-4975

CVE-2013-4975 concerns Hikvision DS-2CD7153-E IP Camera with firmware v4.1.0 b130111 and related devices. The Core Security/CoreLabs advisory documents three vulnerabilities affecting this family: (1) CVE-2013-4975 — privilege escalation via configuration data retrieval and weak encryption to obt...

CVE-2013-4975

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

Unauthorized Access Vulnerability in Hikvision Backup Management Server

Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. An unauthorized access vulnerability exists in the Hikvision Backup Management Server, which can be exploited by an attacker to gain unauthorized access to the system...

Unauthorized Access Vulnerability in Hikvision Cameras

Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. An unauthorized access vulnerability exists in Hikvision cameras, which can be exploited by attackers to perform arbitrary operations...

Hikvision camera has a logic flaw vulnerability

Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. A logic flaw vulnerability exists in Hikvision cameras, which can be exploited by an attacker to access the API without entering a password check...

Weak password vulnerability in Hikvision cameras

Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. A weak password vulnerability exists in Hikvision cameras from 2013 and earlier versions, which can be exploited by an attacker to remotely connect to and control the camera...