Video equipment

This is a full disclosure of recent backdoor integrated into DVR/NVR devices built on top of HiSilicon SoC with Xiaongmai firmware. Described vulnerability allows attacker to gain root shell access and full control of device. Full disclosure format for this report has been chosen due to lack of trust to vendor. Proof of concept code is presented below.

Video conferencing systems, so familiar to us today, have come a long way — more than a hundred years passed from fantastic ideas inspired by belief in unstoppable technical progress to the first mass implementation of video conferencing systems. A lot of dramatic events have come along the way. The way to success wasn’t easy at all.