Unscored severity · published Sep 17, 2013
CVE-2013-3612
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain…
–
CVSS
10.3%
EPSS
No
On KEV
Description
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DV
Dvr0404hd-a · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hd-l · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hd-s · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hd-u · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hf-a-e · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hf-al-e · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hf-s-e · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0404hf-u-e · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0804 · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0804hd-l · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0804hd-s · Dahuasecurity
All versions, or not specified · source: NVD
DV
Dvr0804hf-a-e · Dahuasecurity
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3612
US Government Resource
http://www.kb.cert.org/vuls/id/800094
More from Dvr0404hd-a
–
CVE-2013-5754
The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote…
–
CVE-2013-3615
Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a…
–
CVE-2013-3613
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET…
–
CVE-2013-3614
Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack