Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

- [3. Affected Component & Attack Surface](#3-affected-component--attack-surface)

- [4. Vulnerability Analysis](#4-vulnerability-analysis)

- [5. Impact Assessment](#5-impact-assessment)

- [6. Proof of Concept (Simulated)](#6-proof-of-concept-simulated)

CVE-2017-7921 is an improper authentication vulnerability (CWE-287) in

Hikvision IP cameras and NVRs/DVRs. A crafted `auth` query parameter is

accepted without a valid session, allowing unauthenticated access to

protected endpoints including live snapshots, the user list, and the

This writeup documents a local mock server that reproduces the vulnerable

HTTP behavior. All testing was performed against the mock on loopback; no

| **Vulnerability Type** | CWE-287: Improper Authentication |

| **Target Architecture** | N/A (HTTP-layer simulation) |

| **Impact** | Unauthenticated data disclosure (snapshots, usernames, config) |

| **CVSS v3.1** | 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — per NVD |

**Target:** Local Flask mock (`127.0.0.1:5000`) simulating vulnerable Hikvision endpoints.

**Attacker:** Local terminal with `curl` and the `hikvision_snapshots.py` tool.

**Environment assumptions:** Loopback only; no external network exposure.

I built a mock HTTP server that reproduces only the vulnerable request handling. The mock

is sufficient to demonstrate the bypass because the flaw lives entirely in the HTTP layer: a string comparison on a query parameter.

The mock implements three endpoints with the known magic-auth behavior:

| `/Security/users` | XML list of usernames |

| `/onvif-http/snapshot` | Returns a PNG image |

| `/System/configurationFile` | encrypted config file (contains passwords) |

`hikvision_snapshots.py` is a standalone Python tool I built for interacting with Hikvision cameras. It requires `requests`; `--merge` requires Pillow;

`credentials` requires OpenSSL on the host

**List cameras** Print cameras from the targets file.

**Check (CVE)** – test each camera for CVE-2017-7921 auth bypass (no credentials); optional --save-snapshot for vulnerable devices.

**Credentials** – extract user/password from each camera via CVE (magic auth + config decrypt). Requires OpenSSL.

**Auth check** – verify that username/password are accepted by each camera (no snapshots saved).

**Snapshot all** – fetches one image per camera (valid credentials, or --exploit to use CVE bypass with no credentials).

## 3. Affected Component & Attack Surface

**Component**: Hikvision web server (real devices); Flask mock (lab)

**Endpoint / Interface**: /Security/users, /onvif-http/snapshot,

**Pre-auth reachable**: Yes — the bypass occurs before any session check

**Input source**: auth query parameter (Base64 string)

The server treats a static query parameter as sufficient proof of

authentication. Because the check is a string comparison rather than a

session lookup, any request carrying the expected value is granted access

Any unauthenticated HTTP GET to a protected endpoint with

?auth=YWRtaW46MTEK appended. The value is Base64 for admin:11.

**Confidentiality:** High — live snapshots, username list, and encrypted configuration file are exposed without credentials.

**Integrity:** Low in isolation — the CVE does not provide write access. However, recovered credential(from config decryption) enable authenticated modification.

**Scope:** Single device. Impact grows significantly if the leaked credentials are reused elsewhere on the network.

The following commands demonstrate the bypass against the local mock. They

python3 hikvision_snapshots.py targets.txt check

### 6.2 Extract a snapshot with no credentials

python3 hikvision_snapshots.py targets.txt snapshot --exploit -o ./out