Russian researcher disclosed unpatched vulnerability in DVR/NVR/IP camera devices powered by HiSilicon SOC hardware. And as usually: maybe millions of exposed IoT devices + available information + bad actors... you can be sure there are many bots searching already for the vulnerable devices.
So you better make sure all your vulnerable devices are shielded from the Internet until HiSilicon's partners patch the backdoor.
I am currently working on my hobby project - online scanner - so I took the liberty and implemented online test using the proof-of-concept software provided by the researcher. Now you can test your online cameras and other devices at https://cyrex.tech
Because this is an development site and I may need to limit signups in case of any issues - here is the required invitation code: REDDIT
The vulnerability disclosure is available at https://habr.com/en/post/486856/ and the proof of concept tool is available on Github https://github.com/Snawoot/hisilicon-dvr-telnet and Huawei statement https://www.huawei.com/en/psirt/security-notices/2020/huawei-sn-20200205-01-hisilicon-en .
[link] [comments]