PT-2017-18002 · Dahua · Dahua Dh-Ipc-Hfw4Xxx+11

Published 2017-05-06 · Updated 2019-10-09 · CVE-2017-7927

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dahua DH-IPC-HDBW23A0RN-ZS Dahua DH-IPC-HDBW13A0SN Dahua DH-IPC-HDW1XXX Dahua DH-IPC-HDW2XXX Dahua DH-IPC-HDW4XXX Dahua DH-IPC-HFW1XXX Dahua DH-IPC-HFW2XXX Dahua DH-IPC-HFW4XXX Dahua DH-SD6CXX Dahua DH-NVR1XXX Dahua DH-HCVR4XXX Dahua DH-HCVR5XXX Dahua DHI-HCVR51A04HE-S3 Dahua DHI-HCVR51A08HE-S3 Dahua DHI-HCVR58A32S-S2

Description A Use of Password Hash Instead of Password for Authentication issue was discovered, which could allow a malicious user to bypass authentication without obtaining the actual password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-836

CWE-798

Related Identifiers

CVE-2017-7927

Affected Products

Dahua Dh-Hcvr4Xxx

Dahua Dh-Hcvr5Xxx

Dahua Dh-Ipc-Hdbw13A0Sn

Dahua Dh-Ipc-Hdbw23A0Rn-Zs

Dahua Dh-Ipc-Hfw1Xxx

Dahua Dh-Ipc-Hfw2Xxx

Dahua Dh-Ipc-Hfw4Xxx

Dahua Dh-Nvr1Xxx

Dahua Dh-Sd6Cxx

Dahua Dhi-Hcvr51A04He-S3

Dahua Dhi-Hcvr51A08He-S3

Dahua Dhi-Hcvr58A32S-S2

References · 4

• http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7927 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02 · Note
• http://securityfocus.com/bid/98312 · Note