Buffer overflow in Dahuasecurity Ipc-Hdw1xxx
CVE-2019-9676
Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (36.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dahuasecurity Ipc-hdw1xxx
- Dahuasecurity Ipc-hdw1xxx_firmware
- Dahuasecurity Ipc-hfw1xxx
- Dahuasecurity Ipc-hfw1xxx_firmware
- Dahuasecurity Ipc-hfw2xxx
- Dahuasecurity Ipc-hfw2xxx_firmware
- N/a Ipc-hfw1xxx,ipc-hdw1xxx,ipc-hfw2xxx — versions Build before 2018/11
Weakness classification (CWE)
References
- cybersecurity@dahuatech.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-9676?
- CVE-2019-9676 is a high-severity vulnerability in Dahuasecurity Ipc-Hdw1xxx, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2019-06-12.
- How severe is CVE-2019-9676?
- High severity. CVSS v3 base score is 7.8 out of 10.