Vista VK2 IP Camera Vulnerability – 28th November 2023
Vista has become aware of vulnerabilities within the VK2 range of IP cameras.
We are currently working extensively with the Development Team to implement firmware updates for prompt resolution.
Details are provided below, including the products of the range and how they are each affected.
|1. Ability to inject PHP and modify Admin password to gain access – via user_update.php
|2. Unsupported Web Software: PHP (PHP/7.3.7)
|3. Outdated Server Software: Lighttpd (/1.4.39)
AFFECTED PRODUCTS AND VERSIONS
VK2 range cameras listed below exhibit the above issues. The latest affected firmware version is also given.
Once a firmware resolution is available for the below cameras, details of the updated version will be provided here. Please check regularly for updates to this announcement.
|Last Affected Version
All remaining Vista IP cameras of the VK2 range, essentially those not listed above, exhibit vulnerabilities numbered 2 to 3 only.
Note: they do not exhibit issue 1. inject PHP and modify Admin password to gain access.
These remaining VK2 cameras use older unsupported SOC hardware (System On a Chip) and are no longer supported with later firmware updates.
RECOMMENDATIONS – Recommendations are provided below to minimise impact – these also being “best practices” for any CCTV deployment.
- Provide a dedicated VLAN/Ethernet network for all CCTV devices so as to be separate from the corporate or customers LAN.
- Where connectivity between the networks is required, provide a firewall with relevant firewall rules and policies to block all unnecessary source IP addresses and ports.
- Apply IP whitelists to CCTV devices, such as cameras, to permit only those source IP addresses permitted access i.e. NVR recorder, engineering LAN etc.
- Make use of HTTPS on any CCTV device, where possible, for web login access.
- Ensure admin passwords are changed from their default and to something strong.
Please revisit this page to keep updated on firmware resolutions.