#VU9530 Use of hard-coded credentials in Ds-2cd7153-e and Hikvision DVR/NVR Firmware - CVE-2013-4976

Vulnerability identifier: #VU9530

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear

CVE-ID: CVE-2013-4976

CWE-ID: CWE-798

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerable software:
Ds-2cd7153-e
Hikvision DVR/NVR Firmware

Software vendor:
Hikvision

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to use of hard-coded credentials (even if the built-in anonymous user account was explicitly disabled). A remote attacker can use hard-coded credentials to bypass the anonymous user authentication.

Update to the latest firmware version.

• https://www.coresecurity.com/advisories/hikvision-ip-cameras-multiple-vulnerabilities