CVE-2021-41506
📋 TL;DR
This CVE describes a critical backdoor vulnerability in multiple Xiaongmai DVR/NVR/IP camera models and firmware versions. The vulnerability exists due to hardcoded static root account credentials in the macGuarder and dvrHelper binaries, allowing attackers to gain complete system control. Affected systems include various Xiaongmai hardware models running specific vulnerable firmware versions.
💻 Affected Systems
- Xiaongmai AHB7008T-MH-V2
- AHB7804R-ELS
- AHB7804R-MH-V2
- AHB7808R-MS-V2
- AHB7808R-MS
- AHB7808T-MS-V2
- AHB7804R-LMS
- HI3518_50H10L_S39
📦 What is this software?
Ahb7804r Els Firmware by Xiongmaitech
Ahb7804r Lms Firmware by Xiongmaitech
Ahb7808r Ms Firmware by Xiongmaitech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to gain root access, install malware, exfiltrate video feeds, pivot to internal networks, or render devices inoperable.
Likely Case
Unauthorized access to video surveillance systems, privacy violations, potential ransomware deployment, and use of devices as botnet nodes.
If Mitigated
Limited impact if devices are isolated in secure network segments with strict access controls and monitoring.
🎯 Exploit Status
Multiple public exploit tools exist (hisilicon-dvr-telnet) that allow trivial exploitation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware updates
Vendor Advisory: https://www.xiongmaitech.com/en/index.php/news/info/12/68
Restart Required: Yes
Instructions:
1. Visit vendor advisory URL. 2. Identify your device model. 3. Download latest firmware. 4. Follow vendor's firmware update procedure. 5. Reboot device after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLANs with strict firewall rules preventing external access.
Disable Unnecessary Services
linuxDisable Telnet and other unnecessary network services if not required for operation.
telnetd stop
killall telnetd
🧯 If You Can't Patch
- Immediately remove affected devices from internet-facing networks
- Implement strict network access controls allowing only necessary traffic from trusted sources
🔍 How to Verify
Check if Vulnerable:
Attempt to connect via Telnet to port 23 using known hardcoded credentials from exploit tools. If connection succeeds, device is vulnerable.Check Version:
Check device web interface or use vendor-specific CLI commands to display firmware versionVerify Fix Applied:
After firmware update, attempt Telnet connection with previously working credentials. Connection should fail.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful Telnet logins
- Unexpected root user logins via Telnet
Network Indicators:
- Telnet connections from unexpected sources
- Unusual outbound traffic from DVR/NVR devices
SIEM Query:
source="*dvr*" OR source="*nvr*" AND (event="telnet" OR port=23) AND (user="root" OR auth_success=true)🔗 References
- https://github.com/Snawoot/hisilicon-dvr-telnet
- https://github.com/tothi/hs-dvr-telnet
- https://habr.com/en/post/486856/
- https://www.xiongmaitech.com/en/index.php/news/info/12/68
- https://github.com/Snawoot/hisilicon-dvr-telnet
- https://github.com/tothi/hs-dvr-telnet
- https://habr.com/en/post/486856/
- https://www.xiongmaitech.com/en/index.php/news/info/12/68
