Lucene search

[email protected]NVD:CVE-2017-6343

HistoryFeb 27, 2017 - 7:59 a.m.

CVE-2017-6343

2017-02-2707:59:00

CWE-287

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0.957

Percentile

99.4%

JSON

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117.

Affected configurations

Nvd

Node

dahuasecuritycamera_firmwareMatch2.400.0000.28.r

dahuasecuritynvr_firmwareMatch3.210.0001.10

dahuasecuritysmartpss_firmwareMatch1.16.1

AND

dahuasecuritydhi-hcvr7216a-s3Match-

VendorProductVersionCPE
dahuasecuritycamera_firmware2.400.0000.28.rcpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:*:*:*:*:*:*:*
dahuasecuritynvr_firmware3.210.0001.10cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:*:*:*:*:*:*:*
dahuasecuritysmartpss_firmware1.16.1cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:*:*:*:*:*:*:*
dahuasecuritydhi-hcvr7216a-s3-cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dahuasecurity	camera_firmware	2.400.0000.28.r	cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:::::::*
dahuasecurity	nvr_firmware	3.210.0001.10	cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:::::::*
dahuasecurity	smartpss_firmware	1.16.1	cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:::::::*
dahuasecurity	dhi-hcvr7216a-s3	-	cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:::::::*