LeakIX - Host 122.117.236.200

Host 122.117.236.200

Taiwan

Data Communication Business Group

Vulnerable HiSilicon family DVR

This vulnerability (with proof of concept (PoC) code) affects DVR/NVR devices built using the HiSilicon hi3520d and similar system on a chip (SoC).

Exploiting the vulnerabilities lead to unauthorized remote code execution (RCE) using only the web interface, causing full takeover of the exploited device

IP: 122.117.236.200
Port: 88
URL: http://122.117.236.200:88

First seen 2023-05-18 16:11
Last seen 2023-09-10 09:23
Open for 114 days
- Severity: high
  Fingerprint: 321975614123c6c05f83e99bb5d8a893dc54e908dc54e908dc54e908dc54e908
```
Found HiSiliconDVR firmware:
Hardware: General NBD7024H-P
Vulnerable to multiple issues : LFI, possibly RCE
```
  Found on 2023-05-18 16:11
Create report

2024-04-24 05:18

HTTP/1.0 200 OK
Content-type: text/html
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    
    <title>NETSurveillance WEB</title>
    
    <!-- m.js -->

    <script type="text/javascript" language="JavaScript">
     var bCrossBrow=false;
	 var bnpCheck = false;
var showemailflag=3;
var ShowTipFlag=1;
	 //wzy 20190904
     var g_initWidth = document.documentElement.clientWidth;
	
	// var SupportFind=false;
	    
	if(navigator.platform != "Win32")//
	{
	}
	var userAgent = navigator.userAgent,   
			rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
			rFirefox = /(firefox)\/([\w.]+)/,   
			rOpera = /(opera).+version\/([\w.]+)/,   
			rChrome = /(chrome)\/([\w.]+)/,   
			rSafari = /version\/([\w.]+).*(safari)/;
	var browserMatch = uaMatch(userAgent.toLowerCase());
	 
	if(browserMatch.browser!="IE")
	{
		 bCrossBrow=true;
		  var userla=navigator.browserLanguage;
		  switch (browserMatch.browser)
		{
			case "firefox":
				if (compareBrowser(browserMatch.version,"52.0")){
					if(userla=="zh-cn"){
						alert("您的浏览器太新了,某些功能将不能正常使用,请下载51.0或以前的版本。");
					}else{
						alert("Your browser is too new,Some features will not work properly.Please download 51.0 or earlier.");
					}
				}
				break;
			case "opera":
				if (compareBrowser(browserMatch.version,"34.0")){
					 if(userla=="zh-cn"){
						alert("您的浏览器太新了，请下载33.0或以前的版本。");
					}else{
						alert("Your browser is too new,Some features will not work properly.Please download 33.0 or earlier.");
					}
				}
				break;
			case "chrome":
				if (compareBrowser(browserMatch.version,"45.0")){
					 if(userla=="zh-cn"){
						alert("您的浏览器太新了，请下载44.0或以前的版本。");
					}else{
						alert("Your browser is too new,Some features will not work properly.Please download 44.0 or earlier.");
					}
				}
				break;
			case "safari":
				if (compareBrowser(browserMatch.version,"10.0")){
					 if(userla=="zh-cn"){
						alert("您的浏览器太新了，请下载9.0或以前的版本。");
					}else{
						alert("Your browser is too new,Some features will not work properly.Please download 9.0 or earlier.");
					}
				}
				break;
		}
	}
	
	function compareBrowser(ver1,ver2) {  
      var version1pre = parseFloat(ver1);  
      var version2pre = parseFloat(ver2);  
      var version1next =  ver1.replace(version1pre + ".","");  
      var version2next =  ver2.replace(version2pre + ".","");  
      if(version1pre > version2pre){  
          return true;  
      }else if(version1pre < version2pre){  
      return false;  
      }else{  
          if(version1next > version2next){  
            return true;  
          }else{  
            return false;  
           }  
        }  
	}
	
	//对比版本是否有更新
	function cmpVersion(ver1, ver2) {
		//将版本号分为一个字符数组
		var arrVer1 = ver1.split("=")[1].split(",");
		var arrVer2 = ver2.split("=")[1].split(",");
		for (var i = 0; i < arrVer1.length; ++i) {
			var v1 = arrVer1[i];
			var v2 = arrVer2[i];
			if (v1 == null || v2 == null) {
				break;
			}
			if (parseInt(v1) < parseInt(v2)) {
				return true;
				break;
			}
		}
		 return false;
	}
	
	
	function reminder()
	{
		var isExistOcxFunction = true;
		if ( 3 == showemailflag)
		{
			try {
				ocx.RetrievePassWord(ipaddress, hostport);
			} 
			catch (e)
			{
				isExistOcxFunction = false;
			}
		}
		if (!isExistOcxFunction || showemailflag != 3)
		{
			var nSel=$('langlist').selectedIndex;
			var cLanguage;
			switch(nSel)
		{
		case 0:
             cLanguage="English";
            
             break;
		case 1:

Found 2024-04-24 by HttpPlugin

Create report

Domain summary

No record

Host 122.117.236.200

Taiwan

Vulnerable HiSilicon family DVR

Create report

Domain summary