CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-9676
https://notcve.org/view.php?id=CVE-2019-9676
Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability. • https://www.dahuasecurity.com/support/cybersecurity/details/617 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 50EXPL: 0CVE-2017-9315 – Dahua Technology IP Camera Predictable Password Algorithm Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-9315
Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker. >Los clientes de las cámaras Dahua IP o IP PTZ podrían enviar información relevante del dispositivo para recibir una contraseña temporal limitada temporalmente por un distribuidor autorizado de Dahua para restablecer la contraseña de administrador. El algoritmo empleado en este mecanismo está potencialmente en riesgo de verse comprometido y, consecuentemente, empleado por el atacante. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dahua Technology IP Camera. • http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html •
CVSS: 9.8EPSS: 32%CPEs: 30EXPL: 0CVE-2017-7925
https://notcve.org/view.php?id=CVE-2017-7925
A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information. Se detectó un problema de Contraseña en el Archivo de Configuración en cámaras DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3 y DHI-HCVR58A32S-S2, de Dahua . Se identificó una vulnerabilidad de contraseña en el archivo de configuración, lo que podría conllevar a un usuario malicioso a asumir la identidad de un usuario con privilegios y conseguir acceso a información confidencial. • http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php http://www.securityfocus.com/bid/98312 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02 • CWE-260: Password in Configuration File CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 3%CPEs: 30EXPL: 0CVE-2017-7927
https://notcve.org/view.php?id=CVE-2017-7927
A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obtaining the actual password. Un problema de Uso del Hash de Contraseña en Lugar de Contraseña para Autenticación se detectó en cámaras DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3 y DHI-HCVR58A32S-S2, de Dahua. Se identificó el uso de hash de contraseña en lugar de la contraseña para la vulnerabilidad de autenticación, lo que podría permitir a un usuario malicioso omitir la autenticación sin obtener la contraseña actual. • http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php http://www.securityfocus.com/bid/98312 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02 • CWE-798: Use of Hard-coded Credentials CWE-836: Use of Password Hash Instead of Password for Authentication •