How to remediate – ONVIF Device Services

1. Introduction

The ONVIF Device Services vulnerability means a remote service is responding to requests using the ONVIF protocol. This allows mapping of enabled services, potentially exposing them to unwanted access. Systems commonly affected are IP cameras, network video recorders and other physical security devices. A successful exploit could lead to information disclosure or control of the device.

2. Technical Explanation

The vulnerability occurs because ONVIF services are enabled on a device. Nessus detected this by sending a GetCapabilities SOAP request, indicating the service is accessible. An attacker can use this to discover available features and potentially exploit weaknesses in their implementation. There isn’t a specific CVE associated with simply having the service enabled, but exploitation of vulnerabilities within ONVIF services is common.

• Root cause: The ONVIF service is active and responding to external requests.
• Exploit mechanism: An attacker sends an ONVIF GetCapabilities request to enumerate available features. This information can then be used to identify and exploit specific vulnerabilities within those services, such as default credentials or unpatched flaws.
• Scope: IP cameras, network video recorders (NVRs), and other devices supporting the ONVIF standard are affected. Specific versions depend on the device manufacturer.

3. Detection and Assessment

• Quick checks: Use nmap -sV --script http-onvif to check for the ONVIF service.
• Scanning: Nessus plugin ID 10863 can detect this issue. Other vulnerability scanners may have similar plugins.
• Logs and evidence: Check device logs for SOAP requests related to ONVIF, particularly GetCapabilities. The exact log location varies by vendor.

nmap -sV --script http-onvif 192.168.1.100

4. Solution / Remediation Steps

The following steps provide a way to fix the issue.

4.1 Preparation

• Ensure you have access credentials for the device. A roll back plan involves restoring the previous configuration from the backup.
• A change window may be needed depending on the impact to operations and who should approve it.

4.2 Implementation

1. Step 1: Enable IP filtering on the device, restricting access to ONVIF services only from trusted networks or devices.
2. Step 2: If ONVIF is not required, disable the service entirely through the device’s web interface or configuration file.

4.3 Config or Code Example

Before

// ONVIF service enabled by default in configuration file
onvif_enabled = true

After

// ONVIF service disabled
onvif_enabled = false

4.4 Security Practices Relevant to This Vulnerability

List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice.

• Practice 1: Least privilege – restrict access to sensitive services like ONVIF to only those who need it, reducing the impact if exploited.
• Practice 2: Safe defaults – disable unnecessary services by default to minimise attack surface.

4.5 Automation (Optional)

If suitable, provide a small script or infrastructure code that applies the fix at scale. Only include if safe and directly relevant.

# Example Bash script for disabling ONVIF via API (replace with device-specific commands)
# This is an example only - adapt to your specific device's API
curl -k -X POST -d '{"action":"disable_onvif"}' https:///api/config

5. Verification / Validation

Confirm the fix worked by checking if ONVIF requests are no longer successful.

• Post-fix check: Run nmap -sV --script http-onvif again. The output should not show the ONVIF service running.
• Re-test: Re-run the Nessus scan (plugin ID 10863). It should no longer report the vulnerability.
• Smoke test: Verify that any legitimate functionality relying on ONVIF is still working if it’s needed.
• Monitoring: Monitor device logs for unexpected SOAP requests related to ONVIF.

nmap -sV --script http-onvif 192.168.1.100 (no ONVIF service detected)

6. Preventive Measures and Monitoring

Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.

• Baselines: Update security baselines or policies to require disabling unnecessary services like ONVIF by default.
• Pipelines: Add checks in CI/CD pipelines to ensure that new devices are configured with secure defaults and unnecessary services are disabled.
• Asset and patch process: Implement a regular review cycle for device configurations to identify and address potential vulnerabilities.

7. Risks, Side Effects, and Roll Back

List known risks or service impacts from the change. Give short roll back steps.

• Risk or side effect 1: Disabling ONVIF may break functionality that relies on it (e.g., remote video streaming).
• Risk or side effect 2: Incorrect IP filtering rules could block legitimate access to other services.
• Roll back: Restore the previous configuration from the backup taken in step 4.1. If ONVIF was disabled, re-enable it through the device’s web interface or configuration file.

8. References and Resources

Link only to sources that match this exact vulnerability. Use official advisories and trusted documentation.

• Vendor advisory or bulletin: Check your device manufacturer’s website for specific security advisories related to ONVIF.
• NVD or CVE entry: Search the National Vulnerability Database (NVD) for known vulnerabilities within ONVIF services.
• Product or platform documentation relevant to the fix: Refer to your device’s user manual for instructions on disabling or configuring ONVIF services.