Dahuasecurity
58 CVEs across 748 Dahuasecurity products. Browse Dahuasecurity vulnerabilities, severities, and proof-of-concept exploits.
Dahuasecurity products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39950 | High | 8.6 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device in… |
CVE-2024-39949 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39948 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39947 | Medium | 6.5 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39946 | Medium | 6.0 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39945 | Medium | 4.9 | 2024-07-31 | A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data pa… |
CVE-2024-39944 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to… |
CVE-2023-3836 | Medium | 6.3 | 2023-07-22 | A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devic… |
CVE-2023-3121 | Low | 3.5 | 2023-06-06 | A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the f… |
CVE-2022-30564 | Medium | 5.3 | 2023-02-09 | Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable… |
CVE-2022-45434 | Medium | 5.9 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access contr… |
CVE-2022-45433 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy… |
CVE-2022-45432 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a speci… |
CVE-2022-45431 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sendi… |
CVE-2022-45430 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sen… |
CVE-2022-45429 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL)… |
CVE-2022-45428 | Low | 2.7 | 2022-12-27 | Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific cr… |
CVE-2022-45427 | High | 7.2 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific craf… |
CVE-2022-45426 | Medium | 6.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific cr… |
CVE-2022-45425 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulner… |
CVE-2022-45424 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific… |
CVE-2022-45423 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending… |
CVE-2022-30563 | High | 7.4 | 2022-06-28 | When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying t… |
CVE-2022-30562 | Medium | 4.7 | 2022-06-28 | If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a… |
CVE-2022-30561 | Medium | 5.9 | 2022-06-28 | When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the… |
CVE-2022-30560 | High | 7.4 | 2022-06-28 | When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet t… |
CVE-2021-33046 | Critical | 9.8 | 2022-01-13 | Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to r… |
CVE-2021-33045 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33044 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2020-9502 | Critical | 9.8 | 2020-05-13 | Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predic… |
CVE-2020-9501 | Medium | 5.5 | 2020-05-13 | Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client… |
CVE-2019-9682 | High | 8.1 | 2020-05-13 | Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devi… |
CVE-2020-9500 | Medium | 4.9 | 2020-04-09 | Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command… |
CVE-2020-9499 | High | 7.2 | 2020-04-09 | Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, whi… |
CVE-2019-9680 | Medium | 5.3 | 2019-09-18 | Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious d… |
CVE-2019-9679 | High | 8.8 | 2019-09-18 | Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include… |
CVE-2019-9678 | High | 7.5 | 2019-09-18 | Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet… |
CVE-2019-9677 | Critical | 9.8 | 2019-09-18 | The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packet… |
CVE-2019-9681 | Medium | 5.3 | 2019-09-17 | Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages b… |
CVE-2019-9676 | High | 7.8 | 2019-06-12 | Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the fu… |
CVE-2017-3223 | Critical | 9.8 | 2018-07-24 | Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a st… |
CVE-2017-9317 | High | 8.8 | 2018-05-23 | Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of… |
CVE-2017-9315 | Critical | 9.8 | 2017-11-28 | Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to res… |
CVE-2017-9316 | Medium | 6.5 | 2017-11-27 | Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug funct… |
CVE-2017-9314 | High | 8.8 | 2017-11-13 | Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attac… |
CVE-2017-7927 | High | 7.3 | 2017-05-06 | A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW… |
CVE-2017-7925 | Critical | 9.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-… |
CVE-2017-7253 | High | 8.8 | 2017-03-30 | Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certai… |
CVE-2017-6432 | High | 8.1 | 2017-03-09 | An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unenc… |
CVE-2017-6343 | High | 8.1 | 2017-02-27 | The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Softwa… |
CVE-2017-6342 | Critical | 9.8 | 2017-02-27 | An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS… |
CVE-2017-6341 | Medium | 5.9 | 2017-02-27 | Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19… |
CVE-2013-6117 | | 2014-07-11 | Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change us… | |
CVE-2013-5754 | | 2013-09-17 | The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it… | |
CVE-2013-3615 | | 2013-09-17 | Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwo… | |
CVE-2013-3614 | | 2013-09-17 | Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack. | |
CVE-2013-3613 | | 2013-09-17 | Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack… | |
CVE-2013-3612 | | 2013-09-17 | Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers t… |