PT-2020-20704 · Dahua · Dahua Web P2P Control

Published 2020-05-13 · Updated 2021-07-21 · CVE-2020-9501

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dahua Web P2P control versions with Build time before April 2020

Description The issue allows attackers to obtain Cloud Key information from the Dahua Web P2P control, which is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client and connect to the platform, resulting in additional consumption of platform server resources.

Recommendations For versions with Build time before April 2020, consider restricting access to the Dahua Web P2P control until a fix is available. As a temporary workaround, limit the consumption of platform server resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-9501

Affected Products

Dahua Web P2P Control

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-9501 · Security Note
• https://dahuasecurity.com/support/cybersecurity/details/757 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9501 · Vendor Advisory
• https://t.me/cvenotify/3748 · Telegram Post