Hikvision IP Camera Unauthenticated Denial of Service (DoS)

Hikvision IP Camera Unauthenticated Denial of Service (DoS) Vulnerability

Edit2: Yass 💪, got it: CVE-2025-45851
​
Edit: After a looong conversation with the vendor, I've got these:
"Hi，
    After multiple attempts, we found that whether the device restarts or not is related to the current memory resource usage of the device, so it is not always necessary. The probability of occurrence is lower for devices with abundant memory resources, and higher for devices with limited memory resources. We are researching avoidance methods, such as limiting the number of connections, when device hardware resources cannot be increased. We will release a new version after finding a suitable solution, and only then can we apply for CVE."
...
​"Hi，
    We have provided a fix version that restricts the number of device connections to mitigate such attacks. You can upgrade this version on your device and try to see if it can solve this problem
Firmware :...
"

So the vendor accepted the vulnerability and provided the patch. CVE number is on the way 💪
-----------------------------------------------------------------------------------------------------------------------------

A Denial of Service (DoS) vulnerability was identified in the Hikvision IP Camera, model DS-2CD1321-I, running firmware version V5.7.21 build 230819. This vulnerability can be exploited by sending specially crafted POST requests to the /ISAPI/Security/challenge endpoint. By modifying the PrivateKey parameter to contain an excessively large payload (approximately 100,000 characters) and carefully timing the requests, an attacker can cause resource exhaustion, leading to the crash of the davinci process and ultimately forcing the camera to reboot.

Technical Details

• Vulnerable Component: /ISAPI/Security/challenge endpoint
• Method of Exploitation:
  • Send a POST request with the PrivateKey parameter set to a 100,000-character value.
  • Requests must be sent fast enough to overwhelm the device's resources but not so fast that the device drops the connections.
  • Successful exploitation causes the camera to crash and reboot due to the davinci process exiting unexpectedly.

Discovery Process
To identify this vulnerability, I performed a hardware-level investigation:

1. Disassembly: The camera was disassembled to access internal components.
2. UART Access: An UART interface was located on the device. Two pins were prepared from standard sewing pins to connect the UART interface to an UART-to-USB adapter, as both connectors were female.
3. Power Pin Identification: Pinout analysis was conducted using a multimeter to identify the TX, RX, and GND pins. The proper baud rate was determined to be 115200.
4. Reverse Engineering: Using the UART connection, I monitored device behavior under stress conditions and observed the effects of large payloads on the /ISAPI/Security/challenge endpoint.

Impact
The vulnerability allows attackers to cause a temporary Denial of Service (DoS), disrupting the camera's availability. This could be exploited in scenarios where uninterrupted camera operation is critical, such as surveillance systems. The exploitation not requires authentication, only the access of the camera on network.

Visual Evidences:
​Image of the UART Interface and USB connection:​

Baud Rate Configuration:

Camera Reboot Log:

To summarise very briefly, the IP camera suffers from unauthenticated DoS vulnerability due to resource exhaustion.