CVE-2017-7925

Published: May 6, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.

Affected (15)

Products: Dahuasecurity: Dh Ipc Hdbw23a0rn Zs Firmware, Dh Ipc Hdbw13a0sn Firmware, Dh Ipc Hdw1xxx Firmware, Dh Ipc Hdw2xxx Firmware, Dh Ipc Hdw4xxx Firmware, Dh Ipc Hfw1xxx Firmware, Dh Ipc Hfw2xxx Firmware, Dh Ipc Hfw4xxx Firmware, Dh Sd6cxx Firmware, Dh Nvr1xxx Firmware, Dh Hcvr4xxx Firmware, Dh Hcvr5xxx Firmware, Dhi Hcvr51a04he S3 Firmware, Dhi Hcvr51a08he S3 Firmware, Dhi Hcvr58a32s S2 Firmware

Dahuasecurity

15 products

Dh Ipc Hdbw23a0rn Zs Firmware

Dh Ipc Hdbw13a0sn Firmware

Dh Ipc Hdw1xxx Firmware

Dh Ipc Hdw2xxx Firmware

Dh Ipc Hdw4xxx Firmware

Dh Ipc Hfw1xxx Firmware

Dh Ipc Hfw2xxx Firmware

Dh Ipc Hfw4xxx Firmware

Dhi Hcvr51a04he S3 Firmware

Dhi Hcvr51a08he S3 Firmware

Dhi Hcvr58a32s S2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hdbw23a0rn Zs Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hdbw23a0rn Zs	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hdbw13a0sn Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hdbw13a0sn	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hdw1xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hdw1xxx	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hdw2xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hdw2xxx	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hdw4xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hdw4xxx	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hfw1xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hfw1xxx	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hfw2xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hfw2xxx	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Ipc Hfw4xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Ipc Hfw4xxx	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Sd6cxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Sd6cxx	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Nvr1xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Nvr1xxx	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Hcvr4xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Ddh Hcvr4xxx	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dh Hcvr5xxx Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dh Hcvr5xxx	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dhi Hcvr51a04he S3 Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dhi Hcvr51a04he S3	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dhi Hcvr51a08he S3 Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dhi Hcvr51a08he S3	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dahuasecurity Dhi Hcvr58a32s S2 Firmware	All versions

Running on/with	Platform Versions
Dahuasecurity Dhi Hcvr58a32s S2	All versions

Related CWEs

CWE-260

Password in Configuration File

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (6)

http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php

Source: ics-cert@hq.dhs.gov

PatchVendor Advisory

http://www.securityfocus.com/bid/98312

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/98312

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.