CVE-2018-6299
📋 TL;DR
CVE-2018-6299 is an authentication bypass vulnerability in Hanwha Techwin Smartcams that allows attackers to access camera feeds and administrative functions without valid credentials. This affects multiple Hanwha Techwin smart camera models running vulnerable firmware versions. Attackers can exploit this remotely over the network.
💻 Affected Systems
- Hanwha Techwin Smartcams (various models including SNO-7084R, SNP-6322H, others)
📦 What is this software?
Snh V6410pn Firmware by Hanwha Security
Snh V6410pnw Firmware by Hanwha Security
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of camera systems allowing unauthorized video surveillance, camera manipulation, credential theft, and potential lateral movement to connected networks.
Likely Case
Unauthorized access to live camera feeds, recording manipulation, and camera configuration changes by remote attackers.
If Mitigated
Limited impact if cameras are isolated on separate VLANs with strict network segmentation and access controls.
🎯 Exploit Status
Exploit involves sending specially crafted HTTP requests to bypass authentication checks. Multiple public exploit scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.13.1 and later
Vendor Advisory: https://www.hanwhasecurity.com/support/notice/view.do?idx=100
Restart Required: Yes
Instructions:
1. Download latest firmware from Hanwha Techwin support portal. 2. Backup camera configuration. 3. Upload firmware via web interface. 4. Reboot camera. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with strict firewall rules
Disable Web Interface
allDisable HTTP/HTTPS access if not required for operation
🧯 If You Can't Patch
- Place cameras behind VPN with strict access controls
- Implement network-based intrusion detection to monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Settings > System > Information. Versions below 1.13.1 are vulnerable.Check Version:
curl -k https://[CAMERA_IP]/stw-cgi/system.cgi?msubmenu=info&action=viewVerify Fix Applied:
Verify firmware version is 1.13.1 or higher and test authentication by attempting to access admin pages without credentials.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful access
- Access to admin pages from unusual IP addresses
Network Indicators:
- HTTP requests to /stw-cgi/ paths without authentication headers
- Unusual traffic patterns to camera web interface
SIEM Query:
source="camera_logs" AND (event="authentication_bypass" OR (status=200 AND auth="none" AND uri="/stw-cgi/*"))