CVEvulnerability

CVE-2017-9315

9.8 CRITICAL Published 2017-11-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker.

Affected configurations

• dahuasecurity ipc-hfw1xxx firmware • dahuasecurity ipc-hdw1xxx firmware • dahuasecurity ipc-hdbw1xxx firmware • dahuasecurity ipc-hfw2xxx firmware • dahuasecurity ipc-hdw2xxx firmware • dahuasecurity ipc-hdbw2xxx firmware • dahuasecurity ipc-hfw4xxx firmware • dahuasecurity ipc-hdw4xxx firmware • dahuasecurity ipc-hdbw4xxx firmware • dahuasecurity ipc-hf5xxx firmware • dahuasecurity ipc-hfw5xxx firmware • dahuasecurity ipc-hdw5xxx firmware • dahuasecurity ipc-hdbw5xxx firmware • dahuasecurity ipc-hf8xxx firmware • dahuasecurity ipc-hfw8xxx firmware • dahuasecurity ipc-hdbw8xxx firmware • dahuasecurity ipc-ebw8xxx firmware • dahuasecurity ipc-pfw8xxx firmware • dahuasecurity dh-sd2xxxxx firmware • dahuasecurity ipc-pdbw8xxx firmware • dahuasecurity ipc-hum8xxx firmware • dahuasecurity psd8xxxx firmware • dahuasecurity dh-sd4xxxxx firmware • dahuasecurity dh-sd5xxxxx firmware • dahuasecurity dh-sd6xxxxx firmware

References