Rule Document 1:45413

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Hikvision IP camera admin authentication attempt

Rule Explanation

This event is generated when an attacker attempts to request resources from the Hikvision IP camera's web server using an undisclosed admin authorization technique. Impact: Web Application Attack Details: Rule checks for an attempt to exploit an improper authentication vulnerability present in Hikvision IP cameras. Ease of Attack: Simple; information about the vulnerability and exploitation is publicly-available.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group