PT-2022-27511 · Dahua · Dahua

Published 2022-12-27 · Updated 2023-01-05 · CVE-2022-45429

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dahua software products (affected versions not specified)

Description The issue concerns a server-side request forgery (SSRF) vulnerability. An attacker can access internal resources by concatenating links (URL) that conform to specific rules. This allows unauthorized access to internal resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-45429

Affected Products

Dahua

References · 6

• https://dahuasecurity.com/support/cybersecurity/details/1137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45429 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45429 · Vendor Advisory
• https://t.me/cibsecurity/55432 · Telegram Post
• https://t.me/cvenotify/41278 · Telegram Post
• https://t.me/cvenotify/40819 · Telegram Post