PT-2017-17998 · Hikvision · Hikvision Ds-2Cd4Xx5 Series+5

Published 2017-05-06 · Updated 2024-12-27 · CVE-2017-7923

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hikvision DS-2CD2xx2F-I Series versions V5.2.0 build 140721 through V5.4.0 build 160530 Hikvision DS-2CD2xx0F-I Series versions V5.2.0 build 140721 through V5.4.0 Build 160401 Hikvision DS-2CD2xx2FWD Series versions V5.3.1 build 150410 through V5.4.4 Build 161125 Hikvision DS-2CD4x2xFWD Series versions V5.2.0 build 140721 through V5.4.0 Build 160414 Hikvision DS-2CD4xx5 Series versions V5.2.0 build 140721 through V5.4.0 Build 160421 Hikvision DS-2DFx Series versions V5.2.0 build 140805 through V5.4.5 Build 160928 Hikvision DS-2CD63xx Series versions V5.0.9 build 140305 through V5.3.5 Build 160106

Description A Password in Configuration File issue was discovered in various Hikvision devices. This issue could allow a malicious user to escalate privileges or assume the identity of another user and access sensitive information.

Recommendations For Hikvision DS-2CD2xx2F-I Series versions V5.2.0 build 140721 through V5.4.0 build 160530, update the configuration file to remove the vulnerable password. For Hikvision DS-2CD2xx0F-I Series versions V5.2.0 build 140721 through V5.4.0 Build 160401, update the configuration file to remove the vulnerable password. For Hikvision DS-2CD2xx2FWD Series versions V5.3.1 build 150410 through V5.4.4 Build 161125, update the configuration file to remove the vulnerable password. For Hikvision DS-2CD4x2xFWD Series versions V5.2.0 build 140721 through V5.4.0 Build 160414, update the configuration file to remove the vulnerable password. For Hikvision DS-2CD4xx5 Series versions V5.2.0 build 140721 through V5.4.0 Build 160421, update the configuration file to remove the vulnerable password. For Hikvision DS-2DFx Series versions V5.2.0 build 140805 through V5.4.5 Build 160928, update the configuration file to remove the vulnerable password. For Hikvision DS-2CD63xx Series versions V5.0.9 build 140305 through V5.3.5 Build 160106, update the configuration file to remove the vulnerable password.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-260

Related Identifiers

CVE-2017-7923

Affected Products

Hikvision Ds-2Cd2Xx0F-I Series

Hikvision Ds-2Cd2Xx2F-I Series

Hikvision Ds-2Cd4X2Xfwd Series

Hikvision Ds-2Cd4Xx5 Series

Hikvision Ds-2Cd63Xx Series

Hikvision Ds-2Dfx Series

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-7923 · Security Note
• http://hikvision.com/us/about_10807.html · Vendor Advisory
• http://securityfocus.com/bid/98313 · Note
• https://hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01 · Note
• https://ghostbin.com/paste/q2vq2 · Note
• https://t.me/cvenotify/105649 · Telegram Post
• https://hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer · Note
• https://hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314 · Note