Auth bypass in Dahuasecurity Dvr0404hd-A

CVE-2013-3613

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.

Vulnerability class: Broken Authentication

EPSS: 0.067 (93.2th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)