PT-2017-17008 · Dahua · Nvr Firmware+3

Publicado 2017-02-27 · Atualizado 2019-10-03 · CVE-2017-6341

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 Dahua DHI-HCVR7216A-S3 devices with Camera Firmware 2.400.0000.28.R Dahua DHI-HCVR7216A-S3 devices with SmartPSS Software 1.16.1

Description The issue allows remote attackers to obtain sensitive information by sniffing the network. This is due to the devices sending cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces.

Recommendations For devices with NVR Firmware 3.210.0001.10, update the firmware to a version that does not send cleartext passwords. For devices with Camera Firmware 2.400.0000.28.R, update the firmware to a version that does not send cleartext passwords. For devices with SmartPSS Software 1.16.1, update the software to a version that does not send cleartext passwords. As a temporary workaround, consider restricting access to the network to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-6341

Produtos afetados

Camera Firmware

Dhi-Hcvr7216A-S3

Nvr Firmware

Smartpss

Referências · 5

• http://securityfocus.com/bid/96456 · Nota
• https://osv.dev/vulnerability/CVE-2017-6341 · Aviso do Fabricante
• https://twitter.com/null_ku7/status/835649185168838657 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6341 · Nota de Segurança
• https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html · Nota