PT-2019-19795 · Dahua · Dahua

Published 2019-09-17 · Updated 2020-08-24 · CVE-2019-9681

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dahua products versions prior to August 18, 2019

Description The issue concerns unencrypted online upgrade information in certain firmware packages of Dahua products. This allows attackers to obtain sensitive information by analyzing the firmware packages. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to August 18, 2019, update the firmware to a version released after August 18, 2019, to ensure the online upgrade information is properly encrypted.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2019-9681

Affected Products

Dahua

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-9681 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9681 · Vendor Advisory
• https://dahuasecurity.com/support/cybersecurity/details/637 · Vendor Advisory