Critical severity · published Nov 28, 2017
CVE-2017-9315
Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin…
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dh-sd2xxxxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
DF
Dh-sd4xxxxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
DF
Dh-sd5xxxxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
DF
Dh-sd6xxxxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-ebw8xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdbw1xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdbw2xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdbw4xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdbw5xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdbw8xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdw1xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
IF
Ipc-hdw2xxx Firmware · Dahuasecurity
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9315
Vendor Advisory
http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html