HikVision Password Reset / Flash new FW via RS232

[deanfourie]

Hey guys, I have a hik camera which im locked out of. I know with the new security stuff we are required to go through hik vision to get a new password.

Im about 100% sure its possible to open the device, and possible wire up a RS232 connection and reflash the FW via serial.

Is this possible or has anyone else tried or succeeded in doing this?

Would like to hear your thoughts.

Thanks

 

[alastairstevenson]

What's the firmware version? SADP will show this : Download | Tools - Hikvision

If the firmware is older than 5.4.41 it still has the Hikvision 'backdoor' and the password can be reset / changed using the updated version of the reset tool here : Hikvision camera admin password reset tool

And if it's been hacked and the password changed, you could inspect the password as follows : DS-CD2035-1 password changed, hacked or a fault?

reflash the FW via serial.

And it should be possible to reflash the same firmware using the Hikvision tftp updater tool, which will reset to defaults, if the firmware is valid.

 

[Mike]

FYI you can also download SADP and other software in our wiki

 

[deanfourie]

Thanks for the replies.

If I understand, using TFTP to update the firmware requires you to login? Also I cannot find any firmware for my camera model which I will post shortly.

I guess my questions is, if the firmware is the new firmware and there is no backdoor, surely there is a Eprom or like I say, open the camera and reflash the fw via a TTL serial?

Thanks

 

[alastairstevenson]

using TFTP to update the firmware requires you to login?

No, login is not required for the Hikvision tftp updater.

I guess my questions is, if the firmware is the new firmware and there is no backdoor, surely there is a Eprom or like I say, open the camera and reflash the fw via a TTL serial?

Sure, but pretty easy to try the tftp updater first before taking it apart, if the firmware is new enough that the backdoor exploit is not available.

 

[deanfourie]

Thanks for the reply.

So, using tftp updater, is it possible to reset the password with the new firmware? Or will this reset the firmware or will the old EPROM settings be kept?

Basicly, is it possible to reset the password with any means necessary without having to bin the camera? Even if this means going down the RS232 track and openning the camera?

Thank you again.

 

[alastairstevenson]

Check the firmware version first on the (unspecified) camera - that may be the easiest method to reset the password, as per the link and suggestion stated.

Assuming this isn't a Chinese camera that a firmware install would brick - a tftp update of the same firmware will reset the camera to defaults, allowing access again from a lost password situation.

 

[deanfourie]

Ok cool.

The camera model is DS-2CV2Q21FD-IW at which I cannot find any firmware for.

I have tried the FW update tool, but it appears there is no active web server running on this camera, wheather or no this is because it does not support web access or the original firmware is corrupted.

Access Error: 404 -- Not Found
Can't locate document: /

is what I get. Can anyone possibly point me in the right direction for firmware?

Thanks again!

 

[deanfourie]

I found this. Could this be correct. The model is of the consumer platform.

DOWNLOAD PORTAL

 

[deanfourie]

Ok heres an update. Just tried flashing the above firmware via TFTP, all seemed to go well and update appeared to complete without issue.

However, same issue with the web interface, and when opening SADP, The camera appears but trying to login with password 123456 or 12345 return the error

"device rejected"

Is this a deeper issue?

Thanks

 

[alastairstevenson]

I'm not familiar with that specific camera - but after a reset to defaults SADP would normally show the status as 'Inactive' requiring you to create a strong password of your own choice.
And the camera, according to other posts here, does not have a web GUI.

 

[deanfourie]

Ok, well after the FW upgrade I am still getting it showing as active.

Any ideas?
Thanks

 

[alastairstevenson]

What was the last message on the tftp updater screen?

 

[marku2]

This is Hikvisions little ball it has no web service
If you search on this forum you will find out how to access and set up
Using iVMS then configuration on the camera

 

[marku2]

The password is
admin
admin(device code) the little sticker on the bottom
Add this in iVMS the you can change its password and ip and set up wifi if needed and full access to everything

 

[marku2]

Cool little baby cams

 

[deanfourie]

Ok thanks for all the replys.

Still no luck. Have done FW upgrade over TFTP, tried connecting in IVMS with the Verification Code, still says either incorrect username or password or device rejected.

Any other suggestions? Really dont want to bin it.

Thanks

 

[deanfourie]

Flashing the FW via TFTP is not resetting the password for me

 

[deanfourie]

Here is the export from SADP. Is anyone able to give me a password reset? I really dont want to bin this thing I just bought it

Thanks

 

[alastairstevenson]

Flashing the FW via TFTP is not resetting the password for me

That's a pity. On the older ranges of cameras, this results in a reset to defaults.
From your experience, that doesn't seem to happen for your model.
*edit* What was the last message on the tftp updater window when doing the firmware update?