The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.
References
| Link | Resource |
|---|---|
| http://www.kb.cert.org/vuls/id/800094 | US Government Resource |
| http://www.kb.cert.org/vuls/id/800094 | US Government Resource |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.kb.cert.org/vuls/id/800094 - US Government Resource |
Information
Published : 2013-09-17 12:04
Updated : 2024-11-21 01:58
NVD link : CVE-2013-5754
Mitre link : CVE-2013-5754
CVE.ORG link : CVE-2013-5754
JSON object : View
Products Affected
dahuasecurity
- dvr1604hf-l-e
- dvr3204hf-s
- dvr0404hf-a-e
- dvr0404hf-al-e
- dvr5216l
- dvr2108h
- dvr0804hd-l
- dvr2116c
- dvr0804hf-u-e
- dvr5116he
- dvr5808
- dvr5216a
- dvr5816
- dvr5404
- dvr2104h
- dvr2108he
- dvr5204a
- dvr0804hf-al-e
- dvr3232l
- dvr0404hd-u
- dvr0804
- dvr0804hf-a-e
- dvr5104c
- dvr5104he
- dvr5416
- dvr6404lf-s
- dvr1604hf-u-e
- dvr1604hf-s-e
- dvr1604hf-al-e
- dvr2116he
- dvr2404lf-al
- dvr1604hf-a-e
- dvr2104hc
- dvr5208l
- dvr0404hf-s-e
- dvr5204l
- dvr0804hf-s-e
- dvr5408
- dvr5108he
- dvr1604hd-s
- dvr5116h
- dvr3204lf-al
- dvr2116hc
- dvr0804hd-s
- dvr0404hd-s
- dvr5116c
- dvr5104h
- dvr3204lf-s
- dvr2108c
- dvr0804hf-l-e
- dvr5108h
- dvr2104he
- dvr2404lf-s
- dvr1604hd-l
- dvr0404hd-l
- dvr2108hc
- dvr0404hf-u-e
- dvr5108c
- dvr2404hf-s
- dvr2104c
- dvr5804
- dvr0404hd-a
- dvr3224l
- dvr2116h
- dvr5208a
CWE
CWE-264
Permissions, Privileges, and Access Controls