module
Hikvision DVR RTSP Request Remote Code Execution
| Disclosed | Created |
|---|---|
| 11/19/2014 | 05/30/2018 |
Disclosed
11/19/2014
Created
05/30/2018
Description
This module exploits a buffer overflow in the RTSP request parsing
code of Hikvision DVR appliances. The Hikvision DVR devices record
video feeds of surveillance cameras and offer remote administration
and playback of recorded footage.
The vulnerability is present in several models / firmware versions
but due to the available test device this module only supports
the DS-7204 model.
code of Hikvision DVR appliances. The Hikvision DVR devices record
video feeds of surveillance cameras and offer remote administration
and playback of recorded footage.
The vulnerability is present in several models / firmware versions
but due to the available test device this module only supports
the DS-7204 model.
Author
Mark Schloesser
Platform
Linux
Architectures
armle
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/linux/misc/hikvision_rtsp_bof
msf /(f) > show actions
...actions...
msf /(f) > set ACTION < action-name >
msf /(f) > show options
...show and set options...
msf /(f) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.