9.8

CVE-2019-9677

The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dahuasecurity ≫ Ipc-hdw1x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hdw1x2x Version-
Dahuasecurity ≫ Ipc-hfw1x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hfw1x2x Version-
Dahuasecurity ≫ Ipc-hdw2x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hdw2x2x Version-
Dahuasecurity ≫ Ipc-hfw2x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hfw2x2x Version-
Dahuasecurity ≫ Ipc-hdw4x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hdw4x2x Version-
Dahuasecurity ≫ Ipc-hfw4x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hfw4x2x Version-
Dahuasecurity ≫ Ipc-hdbw4x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hdbw4x2x Version-
Dahuasecurity ≫ Ipc-hdw5x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hdw5x2x Version-
Dahuasecurity ≫ Ipc-hfw5x2x Firmware Version < 2019-08-18
   Dahuasecurity ≫ Ipc-hfw5x2x Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.86% 0.743
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.