PT-2019-16798 · Dahua+1 · Dahua Ipc Hx5X3X+11

Jacob Baines · Published 2019-07-29 · Updated 2020-08-24 · CVE-2019-3948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amcrest IP2M-841B version 2.520.AC00.18.R Dahua IPC-XXBXX version 2.622.0000000.9.R Dahua IPC HX5X3X and HX4X3X version 2.800.0000008.0.R Dahua DH-IPC HX883X and DH-IPC-HX863X version 2.622.0000000.7.R Dahua DH-SD4XXXXX version 2.623.0000000.7.R Dahua DH-SD5XXXXX version 2.623.0000000.1.R Dahua DH-SD6XXXXX versions 2.623.0000000.1.R through 2.640.0000000.2.R Dahua NVR5XX-4KS2 version 3.216.0000006.0.R Dahua NVR4XXX-4KS2 version 3.216.0000006.0.R Dahua NVR2XXX-4KS2 (affected versions not specified)

Description The issue allows an unauthenticated, remote person to access the HTTP endpoint "/videotalk" without requiring authentication. This could potentially allow the person to listen to the audio of the capturing device.

Recommendations For Amcrest IP2M-841B version 2.520.AC00.18.R, consider disabling access to the "/videotalk" endpoint until a patch is available. For Dahua IPC-XXBXX version 2.622.0000000.9.R, restrict access to the "/videotalk" endpoint to minimize the risk of exploitation. For Dahua IPC HX5X3X and HX4X3X version 2.800.0000008.0.R, avoid using the "/videotalk" endpoint until the issue is resolved. For Dahua DH-IPC HX883X and DH-IPC-HX863X version 2.622.0000000.7.R, consider implementing authentication for the "/videotalk" endpoint as a temporary workaround. For Dahua DH-SD4XXXXX version 2.623.0000000.7.R, restrict access to the "/videotalk" endpoint to minimize the risk of exploitation. For Dahua DH-SD5XXXXX version 2.623.0000000.1.R, avoid using the "/videotalk" endpoint until the issue is resolved. For Dahua DH-SD6XXXXX versions 2.623.0000000.1.R through 2.640.0000000.2.R, consider disabling access to the "/videotalk" endpoint until a patch is available. For Dahua NVR5XX-4KS2 version 3.216.0000006.0.R, restrict access to the "/videotalk" endpoint to minimize the risk of exploitation. For Dahua NVR4XXX-4KS2 version 3.216.0000006.0.R, avoid using the "/videotalk" endpoint until the issue is resolved. For Dahua NVR2XXX-4KS2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-3948

Affected Products

Amcrest Ip2M-841B

Dahua Dh-Ipc Hx883X

Dahua Dh-Ipc-Hx863X

Dahua Dh-Sd4Xxxxx

Dahua Dh-Sd5Xxxxx

Dahua Dh-Sd6Xxxxx

Dahua Ipc Hx4X3X

Dahua Ipc Hx5X3X

Dahua Ipc-Xxbxx

Dahua Nvr2Xxx-4Ks2

Dahua Nvr4Xxx-4Ks2

Dahua Nvr5Xx-4Ks2

References · 7

• 🔥 https://tenable.com/security/research/tra-2019-36 · Exploit
• 🔥 http://packetstormsecurity.com/files/153813/Amcrest-Cameras-2.520.AC00.18.R-Unauthenticated-Audio-Streaming.html · Exploit
• 🔥 https://exploit-db.com/exploits/47188 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3948 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3948 · Vendor Advisory
• https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02.pdf · Note
• https://dahuasecurity.com/support/cybersecurity/details/627?us · Note