PT-2017-17613 · Dahua · Dahua Ip Camera

Publicado 2017-03-30 · Atualizado 2019-10-03 · CVE-2017-7253

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dahua IP Camera devices version 3.200.0001.6

Description The issue allows exploitation of Dahua IP Camera devices by using default low-privilege credentials to list all users via a request to a certain URI, and then logging in with admin credentials to obtain full control of the target IP camera. During exploitation, JSON objects are encountered, including a "Component error: login challenge!" message and a result indicating a successful admin login.

Recommendations For Dahua IP Camera devices version 3.200.0001.6, update the device to a version that is not affected by this issue, or change the default low-privilege credentials and admin credentials to prevent unauthorized access. As a temporary workaround, consider restricting access to the URI used in the exploitation steps to minimize the risk of exploitation.

Exploit

Correção

Insecure Storage of Sensitive Information

Enumeração de Fraquezas

CWE-922

Identificadores relacionados

CVE-2017-7253

Produtos afetados

Dahua Ip Camera

Referências · 4

• 🔥 https://gist.github.com/anonymous/16aca69b7dea27cb73ddebb0d9033b02 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7253 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7253 · Aviso do Fabricante
• http://securityfocus.com/bid/97263 · Nota