Hikvision DVR Improper Authentication Vulnerability Allowing Command Execution via Serial Port

An improper authentication vulnerability has been identified in certain Hikvision DVR models. This vulnerability arises from a flawed implementation of authentication for the serial port, enabling an attacker with physical access to connect to the affected DVRs and execute a series of commands. The issue affects Hikvision DVR models DS-7104HGHI-F1 and DS-7204HGHI-F1, specifically those running versions through V4.30.122_201107.

Impact

Exploitation of this vulnerability allows for improper authentication, enabling physical access to the device to be used for unauthorized command execution via the serial port.

Remediation

Users can upgrade to Hikvision DVR firmware version V4.30.123_251114 to address this vulnerability.