9.3

CVE-2017-6432

Medienbericht
An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dahuasecurity ≫ Nvr Firmware Version3.210.0001.10
   Dahuasecurity ≫ Dhi-hcvr7216a-s3 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.03% 0.59
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.html
Third Party Advisory
https://twitter.com/null_ku7/status/839814344351240193
Press/Media Coverage