PT-2017-4331 · Hikvision · Hikvision Ds-2Cd2432F-Iw

Published 2017-01-12 · Updated 2024-08-05 · CVE-2017-14953

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Hikvision DS-2CD2432F-IW (affected versions not specified)

Description: The issue is related to the use of a default SSID without WiFi encryption or authentication in Hikvision IP cameras. This can allow a remote attacker to gain elevated privileges. In a wired configuration, physically proximate attackers can trigger association with an arbitrary access point by leveraging the default SSID. The vendor considers this an increase to the attack surface rather than a vulnerability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BDU:2024-06775

CVE-2017-14953

Affected Products

Hikvision Ds-2Cd2432F-Iw

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-14953 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06775 · Security Note
• https://t.me/cvenotify/89270 · Telegram Post
• http://seclists.org/fulldisclosure/2017/Nov/43 · Note
• https://t.me/cvenotify/83672 · Telegram Post
• http://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html · Note
• https://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html · Note
• https://seclists.org/fulldisclosure/2017/Nov/43 · Note