InfoSecBulletin Cybersecurity for mankind
Hikvision, a top provider of network cameras, has issued firmware updates to fix a security vulnerability that could reveal users’ Dynamic DNS credentials. This issue impacts various Hikvision camera models and may allow attackers to access sensitive information or disrupt camera communication with the Dynamic DNS service.
The Vulnerability:
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Older Hikvision network cameras relied on HTTP for communication with Dynamic DNS providers like DynDNS and NO-IP. This exposed usernames and passwords as they were sent in cleartext, making them vulnerable to interception.
Impact:
An attacker exploiting this vulnerability could:
Steal Dynamic DNS Credentials:
Capture usernames and passwords, potentially gaining unauthorized access to the user’s Dynamic DNS account.
Disrupt Communication:
Interfere with the camera’s connection to the Dynamic DNS service, preventing remote access to the camera.
Launch Further Attacks:
Use the compromised Dynamic DNS account to redirect traffic or launch other malicious activities.
Affected Products:
A wide range of Hikvision network camera models are affected, including:
DS-2CD1xxxG0, DS-2CD2xx1G0, DS-2CD3xx1G0, IPC-xxxxH (versions prior to V5.7.23 build241008)
DS-2CD29xxG0 (versions prior to V5.7.21 build240814)
DS-2CD1xxxG2, DS-2CD3xx1G2, HWI-xxxxHA, IPC-xxxxHA (versions prior to V5.8.4 build240613)
DS-2CD2xxxG2, DS-2CD3xxxG2 (versions prior to V5.7.18 build240826)
DS-2CD2xxxFWD (versions prior to V5.6.821 build240409)
Solution:
Hikvision fixed the vulnerability by releasing updated firmware that requires HTTPS communication with Dynamic DNS services. Affected camera users should update their firmware immediately.
