Auth bypass in Dahuasecurity Ipc-Hdbw4x00
CVE-2017-9316
Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.
Vulnerability class: Broken Authentication
EPSS: 0.019 (77.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.
Affected products
- Dahuasecurity Ipc-hdbw4x00
- Dahuasecurity Ipc-hdbw4x00_firmware — versions 2.400.0000.3.r.20150312, 2.420.0006.0.r.20150311
- Dahuasecurity Ipc-hdbw5x00
- Dahuasecurity Ipc-hdbw5x00_firmware — versions 2.400.0000.3.r.20150312, 2.420.0006.0.r.20150311
- Dahuasecurity Ipc-hdw4300s
- Dahuasecurity Ipc-hdw4300s_firmware — versions 2.240.0009.0.r.20131015, 2.400.0000.0.r.20131231, 2.420.0000.0.r.20140419
- Dahuasecurity Ipc-hdw4x00
- Dahuasecurity Ipc-hdw4x00_firmware — versions 2.400.0000.3.r.20150312, 2.420.0006.0.r.20150311
- Dahuasecurity Ipc-hdw5x00
- Dahuasecurity Ipc-hdw5x00_firmware — versions 2.400.0000.3.r.20150312, 2.420.0006.0.r.20150311
Weakness classification (CWE)
References
- cybersecurity@dahuatech.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-9316?
- CVE-2017-9316 is a medium-severity vulnerability in Dahuasecurity Ipc-Hdbw4x00, classified under Improper Authentication. CVSS score: 6.5/10. Published 2017-11-27.
- How severe is CVE-2017-9316?
- Medium severity. CVSS v3 base score is 6.5 out of 10.