Login Request a demo
Medium severity · published Sep 17, 2019
CVE-2019-9681
Online upgrade information in some firmware packages of Dahua products is not encrypted
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipc-hdbw4x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hdw1x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hdw2x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hdw4x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hdw5x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hfw1x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hfw2x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hfw4x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
IF
Ipc-hfw5x2x Firmware · Dahuasecurity
before 2019-08-18 · source: NVD
Affected product
IF
Ipc-hdbw4x2x Firmware
Dahuasecurity
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9681
Patch
https://www.dahuasecurity.com/support/cybersecurity/details/637
More from Ipc-hdbw4x2x Firmware
9.8
CVE-2019-9677
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets
8.8
CVE-2019-9679
Some of Dahua's Debug functions do not have permission separation
7.5
CVE-2019-9678
Some Dahua products have the problem of denial of service during the login process
5.3
CVE-2019-9680
Some Dahua products have information leakage issues