CVE-2022-45424

Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dahuasecurity:dss_express:7.002.1760000.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:7.002.1760000.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.1.1:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss7016d-s2:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss7016dr-s2:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss4004-s2:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:29

Type Values Removed Values Added
References () https://www.dahuasecurity.com/support/cybersecurity/details/1137 - Patch, Vendor Advisory () https://www.dahuasecurity.com/support/cybersecurity/details/1137 - Patch, Vendor Advisory

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-522 CWE-306

Information

Published : 2022-12-27 18:15

Updated : 2024-11-21 07:29


NVD link : CVE-2022-45424

Mitre link : CVE-2022-45424

CVE.ORG link : CVE-2022-45424


JSON object : View

Products Affected

dahuasecurity

  • dhi-dss7016d-s2_firmware
  • dss_professional
  • dhi-dss4004-s2_firmware
  • dhi-dss7016d-s2
  • dhi-dss4004-s2
  • dss_express
  • dhi-dss7016dr-s2_firmware
  • dhi-dss7016dr-s2
CWE
CWE-306

Missing Authentication for Critical Function