Sign-up

ID

VAR-201705-3744


CVE

CVE-2017-7927


TITLE

Dahua Technology Authentication Authentication vulnerability

Trust: 0.8

sources: IVD: f9954bac-60c9-435b-9538-cebe46db3539 // CNVD: CNVD-2017-06997

DESCRIPTION

plural Dahua The product contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Dahua Technology Authentication is an access control reader produced by Dahua Technology. Dahua Technology Authentication has an authentication vulnerability. An attacker could exploit the vulnerability to gain unauthorized access to restricted content by bypassing expected security restrictions. Dahua DH-IPC-HDBW23A0RN-ZS, etc. are all camera products of Dahua Company in China. A security vulnerability exists in several Dahua products due to the program's use of password hashes instead of passwords to perform authentication. The following products are affected: Dahua DH-IPC-HDBW23A0RN-ZS; DH-IPC-HDBW13A0SN; DH-IPC-HDW1XXX; DH-IPC-HDW2XXX; DH-IPC-HDW4XXX; DH-IPC-HFW4XXX; DH-SD6CXX; DH-NVR1XXX; DH-HCVR4XXX; DH-HCVR5XXX; DHI-HCVR51A04HE-S3; DHI-HCVR51A08HE-S3;

Trust: 1.62

sources: JVNDB: JVNDB-2017-003972 // CNVD: CNVD-2017-06997 // BID: 98312 // VULHUB: VHN-116130

IOT TAXONOMY

category:['IoT', 'ICS']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: f9954bac-60c9-435b-9538-cebe46db3539 // CNVD: CNVD-2017-06997

AFFECTED PRODUCTS

vendor:dahuasecuritymodel:dh-sd6cxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hfw1xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hdw2xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hdw1xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-nvr1xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hdbw13a0snscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hdw4xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hfw4xxxscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hdbw23a0rn-zsscope:eqversion: -

Trust: 1.6

vendor:dahuasecuritymodel:dh-ipc-hfw2xxxscope:eqversion: -

Trust: 1.6

vendor:dahuamodel:dh-ipc-hdbw23a0rn-zsscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hdbw13a0snscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hdw1xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hdw2xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hdw4xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hfw1xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hfw2xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-ipc-hfw4xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-sd6cxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-nvr1xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-hcvr4xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dh-hcvr5xxxscope: - version: -

Trust: 1.4

vendor:dahuamodel:dhi-hcvr51a04he-s3scope: - version: -

Trust: 1.4

vendor:dahuamodel:dhi-hcvr51a08he-s3scope: - version: -

Trust: 1.4

vendor:dahuamodel:dhi-hcvr58a32s-s2scope: - version: -

Trust: 1.4

vendor:dahuasecuritymodel:dh-hcvr4xxxscope:eqversion: -

Trust: 1.0

vendor:dahuasecuritymodel:dh-hcvr5xxxscope:eqversion: -

Trust: 1.0

vendor:dahuasecuritymodel:dhi-hcvr51a04he-s3scope:eqversion: -

Trust: 1.0

vendor:dahuasecuritymodel:dhi-hcvr58a32s-s2scope:eqversion: -

Trust: 1.0

vendor:dahuasecuritymodel:dhi-hcvr51a08he-s3scope:eqversion: -

Trust: 1.0

vendor:dahuasecuritymodel:dhi-hcvr58a32s-s2scope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dhi-hcvr51a08he-s3scope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dhi-hcvr51a04he-s3scope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-sd6cxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-nvr1xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hfw4xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hfw2xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hfw1xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hdw4xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hdw2xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hdw1xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hdbw23a0rn-zsscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-ipc-hdbw13a0snscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-hcvr5xxxscope:eqversion:0

Trust: 0.3

vendor:dahuasecuritymodel:dh-hcvr4xxxscope:eqversion:0

Trust: 0.3

vendor:dh ipc hdbw23a0rn zsmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh nvr1xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh hcvr4xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh hcvr5xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dhi hcvr51a04he s3model: - scope:eqversion: -

Trust: 0.2

vendor:dhi hcvr51a08he s3model: - scope:eqversion: -

Trust: 0.2

vendor:dhi hcvr58a32s s2model: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hdbw13a0snmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hdw1xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hdw2xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hdw4xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hfw1xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hfw2xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh ipc hfw4xxxmodel: - scope:eqversion: -

Trust: 0.2

vendor:dh sd6cxxmodel: - scope:eqversion: -

Trust: 0.2

sources: IVD: f9954bac-60c9-435b-9538-cebe46db3539 // CNVD: CNVD-2017-06997 // BID: 98312 // JVNDB: JVNDB-2017-003972 // CNNVD: CNNVD-201704-1043 // NVD: CVE-2017-7927

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-7927
value: HIGH

Trust: 1.0

NVD: CVE-2017-7927
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-06997
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201704-1043
value: HIGH

Trust: 0.6

IVD: f9954bac-60c9-435b-9538-cebe46db3539
value: HIGH

Trust: 0.2

VULHUB: VHN-116130
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-7927
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-06997
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: f9954bac-60c9-435b-9538-cebe46db3539
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-116130
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-7927
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.0

Trust: 1.8

sources: IVD: f9954bac-60c9-435b-9538-cebe46db3539 // CNVD: CNVD-2017-06997 // VULHUB: VHN-116130 // JVNDB: JVNDB-2017-003972 // CNNVD: CNNVD-201704-1043 // NVD: CVE-2017-7927

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.9

problemtype:CWE-836

Trust: 1.8

sources: VULHUB: VHN-116130 // JVNDB: JVNDB-2017-003972 // NVD: CVE-2017-7927

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201704-1043

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201704-1043

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-003972

PATCH
title:Cybersecurity Statement - March 6th 2017url:http://www.dahuasecurity.com/en/us/single.php?nid=354
Trust: 0.8
title:Cybersecurity Vulnerability Update - March 8 2017url:http://www.dahuasecurity.com/en/us/single.php?nid=364
Trust: 0.8
title:Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (030617)url:http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php
Trust: 0.8
title:Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (04032017)url:http://us.dahuasecurity.com/en/us/Security-Bulletin_04032017.php
Trust: 0.8
title:Security Notification DHCC-201703-01url:http://www1.dahuasecurity.com/annoucementsingle/security-notification-dhcc-201703-01-112.html
Trust: 0.8
title:Patch for Dahua Technology Authentication Authentication Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/93997
Trust: 0.6
title:Repair measures for various UOB product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99752
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-06997 // 
            
            
            
            JVNDB: JVNDB-2017-003972 // 
            
            
            
            CNNVD: CNNVD-201704-1043

EXTERNAL IDS
db:NVDid:CVE-2017-7927
Trust: 3.6
db:ICS CERTid:ICSA-17-124-02
Trust: 2.8
db:BIDid:98312
Trust: 2.6
db:CNNVDid:CNNVD-201704-1043
Trust: 0.9
db:CNVDid:CNVD-2017-06997
Trust: 0.8
db:JVNid:JVNVU98841854
Trust: 0.8
db:JVNDBid:JVNDB-2017-003972
Trust: 0.8
db:IVDid:F9954BAC-60C9-435B-9538-CEBE46DB3539
Trust: 0.2
db:VULHUBid:VHN-116130
Trust: 0.1
sources:
            
            
            IVD: f9954bac-60c9-435b-9538-cebe46db3539 // 
            
            
            
            CNVD: CNVD-2017-06997 // 
            
            
            
            VULHUB: VHN-116130 // 
            
            
            
            BID: 98312 // 
            
            
            
            JVNDB: JVNDB-2017-003972 // 
            
            
            
            CNNVD: CNNVD-201704-1043 // 
            
            
            
            NVD: CVE-2017-7927

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-124-02
Trust: 2.8
url:http://www.securityfocus.com/bid/98312
Trust: 2.3
url:http://us.dahuasecurity.com/en/us/security-bulletin_030617.php
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-7927
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7927
Trust: 0.8
url:http://jvn.jp/vu/jvnvu98841854/index.html
Trust: 0.8
url:https://github.com/mcw0/poc/blob/master/dahua-backdoor.txt
Trust: 0.8
url:https://github.com/mcw0/poc/blob/master/dahua-backdoor-poc.py
Trust: 0.8
url:www.dahuasecurity.com
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-06997 // 
            
            
            
            VULHUB: VHN-116130 // 
            
            
            
            BID: 98312 // 
            
            
            
            JVNDB: JVNDB-2017-003972 // 
            
            
            
            CNNVD: CNNVD-201704-1043 // 
            
            
            
            NVD: CVE-2017-7927

CREDITS
Bashis
Trust: 0.3
sources:
            
            
            BID: 98312

SOURCES
db:IVDid:f9954bac-60c9-435b-9538-cebe46db3539
db:CNVDid:CNVD-2017-06997
db:VULHUBid:VHN-116130
db:BIDid:98312
db:JVNDBid:JVNDB-2017-003972
db:CNNVDid:CNNVD-201704-1043
db:NVDid:CVE-2017-7927

LAST UPDATE DATE
2024-11-23T22:56:13.270000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-06997date:2017-06-27T00:00:00
db:VULHUBid:VHN-116130date:2019-10-09T00:00:00
db:BIDid:98312date:2017-05-23T16:23:00
db:JVNDBid:JVNDB-2017-003972date:2017-07-13T00:00:00
db:CNNVDid:CNNVD-201704-1043date:2019-10-17T00:00:00
db:NVDid:CVE-2017-7927date:2024-11-21T03:32:58.963

SOURCES RELEASE DATE
db:IVDid:f9954bac-60c9-435b-9538-cebe46db3539date:2017-05-19T00:00:00
db:CNVDid:CNVD-2017-06997date:2017-05-19T00:00:00
db:VULHUBid:VHN-116130date:2017-05-06T00:00:00
db:BIDid:98312date:2017-05-04T00:00:00
db:JVNDBid:JVNDB-2017-003972date:2017-06-13T00:00:00
db:CNNVDid:CNNVD-201704-1043date:2017-04-21T00:00:00
db:NVDid:CVE-2017-7927date:2017-05-06T00:29:00.460