Over 80,000 Unpatched Hikvision Cameras Exposed to Takeover

Cybersecurity firm Cyfirma has identified more than 80,000 Hikvision cameras that haven’t been patched against a critical code execution vulnerability exploited in the wild.

Tracked as CVE-2021-36260, the vulnerability leads to root access and allows an attacker to take full control of a device and potentially compromise the entire network. More than 70 Hikvision device models are impacted.

The security bug has a CVSS rating of 9.8, given that exploitation only requires access to the HTTP(S) server port (typically 80/443), without authentication.

Exploits targeting the vulnerability were published in October 2021 and February 2022. In December 2021, the Mirai-based ‘Moobot’ botnet was observed targeting the vulnerability in attacks.

In January 2022, CISA added the security flaw to its ‘must-patch’ list, which catalogs vulnerabilities for which the agency has evidence of in-the-wild exploitation.

Fixes for CVE-2021-36260 have been available since September 2021, but tens of thousands of Hikvision cameras and NVRs remain unpatched.

According to Cyfirma, there are over 80,000 unpatched Hikvision devices – out of a total of 285,000 – that are accessible from the internet, thus exposed to potential takeover.

More than 2,000 organizations in over 100 countries are potentially exposed to attacks, especially since many of the vulnerable devices also have multiple ports opened, the cybersecurity firm says in a report (PDF).

The largest number of vulnerable devices are located in China (roughly 12,700), US (~10,000), Vietnam (~7,300), UK (~4,800), and Ukraine (~3,000).

Cyfirma also notes that it has reason to believe that Chinese and Russian advanced persistent threat (APT) actors are likely to exploit vulnerabilities in these devices.

“Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale. These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization’s environment,” Cyfirma says.

Related: Unpatched Micodus GPS Tracker Vulnerabilities Allow Hackers to Remotely Disable Cars

Related: Many IoT Devices Exposed to Attacks Due to Unpatched Flaw in uClibc Library

Related: CISA Warns of Hikvision Camera Flaw as U.S. Aims to Rid Chinese Gear From Networks