CVE-2017-14953 – HikVision Wi-Fi IP Camera Wireless Access Point State

https://notcve.org/view.php?id=CVE-2017-14953

HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an increase to the attack surface of the product ** EN DISPUTA ** Las cámaras IP HikVision, cuando se utilizan en una configuración por cable, permiten que los atacantes cercanos físicamente desencadenen la asociación con un punto de acceso arbitrario utilizando un SSID por defecto sin cifrado o autenticación de wifi. NOTA: El vendedor afirma que esto no es una vulnerabilidad, sino más bien un aumento de la superficie de ataque del producto. HikVision Wi-Fi IP cameras come with a default SSID "davinci", with a setting of no WiFi encryption or authentication. Depending on the firmware version, there is no configuration option within the camera to turn off Wi-Fi. • http://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html http://seclists.org/fulldisclosure/2017/Nov/43 • CWE-311: Missing Encryption of Sensitive Data •