Reeperbahn - checking security cameras

Introduction

I recently got curious about the cameras in a bar I visit from time to time. Some of you may have heard about command injection before. Well, I guess Hikvision has some experience with that: CVE-2021-36260.

The vulnerability is quite an old one, but that actually made it more interesting to me. Infrastructure in bars is often poorly maintained, or sometimes not maintained at all. Bars usually focus on drink prices, customer experience, and daily operations, which is something completely different from what I am used to. With that in mind, it makes sense that buying and maintaining this kind of infrastructure has to be cheap. And cheap, forgotten infrastructure can quickly become an interesting security risk. 😀

At some point, I spotted one of those cameras:

Main part

So I made up my mind, grabbed my single-board computer, installed Armbian, and set up WireGuard for a secure connection to one of my servers.

The idea was to create a small remote setup that could be used for controlled testing and observation without exposing my own network directly.

In general, this kind of scenario shows how realistic attacker behavior can be. Weak network separation, leaked Wi-Fi credentials, outdated firmware, and forgotten devices can turn ordinary infrastructure into a potential entry point.

This article is not meant to provide a step-by-step exploitation guide. The goal is to raise awareness and show how exposed businesses can be when security hardware is installed once and then forgotten.

However referring to the CVE-2021-36260 with it's testing script Aiminsun/CVE-2021-36260 and the ONVIF Protocol (for detection of internal ip addresses) the CVE could not be confirmed.

Basic setup:

Conclusion

After around 12 hours of research, planning, and testing, there was no real exploit outcome. Still, the scenario itself was useful because it showed how important basic security hygiene is.

The most important part is not whether one specific CVE worked or not. The important part is that infrastructure like this should never be blindly trusted or left unmanaged.

Learnings

• It is a good idea to separate networks properly. Guest/Admin networks should never provide access to critical infrastructure.
• I would generally recommend keeping firmware up to date. However, with supply chain attacks becoming more common, I would also be careful about blindly installing every update without checking where it comes from and whether it is actually needed.
• Keep this kind of infrastructure locked inside its own restricted network and limit access as much as possible. Nobody really knows what the firmware is doing, especially when it is proprietary and closed source.