Probing the Xiongmai/HiSilicon SoC Vulnerability

This report details a critical firmware backdoor in HiSilicon-based IP video devices from Xiongmai that activates a telnet service via a "secret knock" on TCP/9530; the backdoor uses a hard-coded pre-shared key recoverable from firmware, and further weaknesses in the devices' PRNGs make challenge-response authentication predictable. Censys scanning found thousands of exposed devices globally (notably ~9,362 speaking the HiSilicon protocol), commonly with RTSP and HTTP also accessible, increasing risk of remote compromise, surveillance, or incorporation into botnets.