Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-10710: Hisilicon Hi3510 IP cameras expose Wi‑Fi passwords
CVE-2019-10710 · published 7 years ago
Summary
IP cameras that run Hisilicon Hi3510 firmware let anyone with a valid login view the network's Wi‑Fi password in plain text through a special web request. This means an attacker who can log in to the camera could steal the Wi‑Fi credentials and potentially access other devices on the network. Apply the vendor's firmware update or restrict access to the camera's web interface to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hisilicon | hi3510_firmware |
All versions
cpe:2.3:o:hisilicon:hi3510_firmware:-:*:*:*:*:*:*:* |
Original advisory text
Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific...
Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
References
- https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/ Mitigation Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published23 Apr 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-10710 · NVD
Track software like this
Free during beta