CVE-2017-7927

A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obtaining the actual password.
References
Link Resource
http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php Patch Vendor Advisory
http://www.securityfocus.com/bid/98312 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02 Mitigation Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hdbw23a0rn-zs:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hdbw13a0sn:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hdw1xxx:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hdw2xxx:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hdw4xxx:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hfw1xxx:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hfw2xxx:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-ipc-hfw4xxx:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-sd6cxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-sd6cxx:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-nvr1xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-nvr1xxx:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-hcvr4xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:ddh-hcvr4xxx:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:dahuasecurity:dh-hcvr5xxx_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dh-hcvr5xxx:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:dahuasecurity:dhi-hcvr51a04he-s3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-hcvr51a04he-s3:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:dahuasecurity:dhi-hcvr51a08he-s3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-hcvr51a08he-s3:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:dahuasecurity:dhi-hcvr58a32s-s2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-hcvr58a32s-s2:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-05-06 00:29

Updated : 2024-02-28 15:44


NVD link : CVE-2017-7927

Mitre link : CVE-2017-7927

CVE.ORG link : CVE-2017-7927


JSON object : View

Products Affected

dahuasecurity

  • dh-hcvr5xxx_firmware
  • dh-nvr1xxx_firmware
  • dh-ipc-hfw2xxx
  • dh-ipc-hdw4xxx_firmware
  • dh-ipc-hdw4xxx
  • dh-ipc-hfw4xxx_firmware
  • dh-ipc-hdw1xxx
  • dh-ipc-hdw2xxx_firmware
  • dh-nvr1xxx
  • dhi-hcvr51a08he-s3
  • dh-sd6cxx_firmware
  • dh-sd6cxx
  • dh-ipc-hdbw13a0sn
  • dh-ipc-hdbw13a0sn_firmware
  • dh-ipc-hdw2xxx
  • ddh-hcvr4xxx
  • dh-ipc-hfw1xxx
  • dh-ipc-hdw1xxx_firmware
  • dh-ipc-hfw4xxx
  • dh-hcvr5xxx
  • dhi-hcvr51a08he-s3_firmware
  • dh-ipc-hdbw23a0rn-zs
  • dhi-hcvr58a32s-s2
  • dhi-hcvr58a32s-s2_firmware
  • dh-hcvr4xxx_firmware
  • dh-ipc-hfw2xxx_firmware
  • dh-ipc-hfw1xxx_firmware
  • dhi-hcvr51a04he-s3_firmware
  • dh-ipc-hdbw23a0rn-zs_firmware
  • dhi-hcvr51a04he-s3
CWE
CWE-798

Use of Hard-coded Credentials

CWE-836

Use of Password Hash Instead of Password for Authentication