PT-2017-18000 · Dahua · Dahua Dh-Ipc-Hfw4Xxx+11

Bashis · Published 2017-05-06 · Updated 2019-10-09 · CVE-2017-7925

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dahua DH-IPC-HDBW23A0RN-ZS Dahua DH-IPC-HDBW13A0SN Dahua DH-IPC-HDW1XXX Dahua DH-IPC-HDW2XXX Dahua DH-IPC-HDW4XXX Dahua DH-IPC-HFW1XXX Dahua DH-IPC-HFW2XXX Dahua DH-IPC-HFW4XXX Dahua DH-SD6CXX Dahua DH-NVR1XXX Dahua DH-HCVR4XXX Dahua DH-HCVR5XXX Dahua DHI-HCVR51A04HE-S3 Dahua DHI-HCVR51A08HE-S3 Dahua DHI-HCVR58A32S-S2

Description A password in configuration file issue was discovered, which could allow a malicious user to assume the identity of a privileged user and gain access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-260

CWE-522

Related Identifiers

CVE-2017-7925

Affected Products

Dahua Dh-Hcvr4Xxx

Dahua Dh-Hcvr5Xxx

Dahua Dh-Ipc-Hdbw13A0Sn

Dahua Dh-Ipc-Hdbw23A0Rn-Zs

Dahua Dh-Ipc-Hfw1Xxx

Dahua Dh-Ipc-Hfw2Xxx

Dahua Dh-Ipc-Hfw4Xxx

Dahua Dh-Nvr1Xxx

Dahua Dh-Sd6Cxx

Dahua Dhi-Hcvr51A04He-S3

Dahua Dhi-Hcvr51A08He-S3

Dahua Dhi-Hcvr58A32S-S2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7925 · Security Note
• http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02 · Note
• http://securityfocus.com/bid/98312 · Note