PT-2022-6097 · Dahua · Dhi-Dss7016Dr-S2+4

Published 2022-12-27 · Updated 2023-01-05 · CVE-2022-45427

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dahua software products (affected versions not specified) DSS Professional (affected versions not specified) DSS Express (affected versions not specified) DHI-DSS4004-S2 (affected versions not specified) DHI-DSS7016D-S2 (affected versions not specified) DHI-DSS7016DR-S2 (affected versions not specified)

Description The issue is related to an unrestricted upload of file vulnerability. After obtaining administrator permissions, an attacker can upload arbitrary files by sending a crafted packet to the vulnerable interface. This can be exploited remotely.

Recommendations For Dahua software products, consider restricting access to the vulnerable interface until a patch is available. For DSS Professional, DSS Express, DHI-DSS4004-S2, DHI-DSS7016D-S2, and DHI-DSS7016DR-S2, restrict the ability to upload files to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-00035

CVE-2022-45427

Affected Products

Dhi-Dss4004-S2

Dhi-Dss7016Dr-S2

Dss Express

Dss Professional

Dahua

References · 8

• https://dahuasecurity.com/support/cybersecurity/details/1137 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45427 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45427 · Security Note
• https://t.me/cvenotify/41274 · Telegram Post
• https://vuldb.com/ru/?id.216891 · Note
• https://t.me/cvenotify/40821 · Telegram Post
• https://t.me/cibsecurity/55435 · Telegram Post