Dahua Updates DVR, IP Cameras

Thursday, May 4, 2017 @ 03:05 PM gHale


Dahua Technology Co., Ltd released a firmware update to mitigate vulnerabilities in its digital video recorders and IP cameras, according to a report with ICS-CERT.

The remotely exploitable vulnerabilities, discovered by researcher Bashis without coordination with ICS-CERT, include a use of password hash instead of password for authentication and password in configuration file.

RELATED STORIES
Advantech Fixes WebAccess Hole
Rockwell Mitigates Issues with PACs
Advantech B+B SmartWorx Gateway Hole
CyberVision IoT Platform Vulnerability

The following Dahua Technology Co., Ltd (Dahua) network cameras suffer from the issues:
• DH-IPC-HDBW23A0RN-ZS
• DH-IPC-HDBW13A0SN
• DH-IPC-HDW1XXX
• DH-IPC-HDW2XXX
• DH-IPC-HDW4XXX
• DH-IPC-HFW1XXX
• DH-IPC-HFW2XXX
• DH-IPC-HFW4XXX
• DH-SD6CXX
• DH-NVR1XXX
• DH-HCVR4XXX
• DH-HCVR5XXX

The following Dahua Digital Video Recorders (DVRs) suffer from the issues:
• DHI-HCVR51A04HE-S3
• DHI-HCVR51A08HE-S3
• DHI-HCVR58A32S-S2

Successful exploitation of these vulnerabilities could allow the attacker to obtain user credentials, including password hashes, and use these credentials to bypass authentication.

The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obstaining the actual password.

CVE-2017-7927 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.3.

The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.

CVE-2017-7925 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.8.

The product sees action in the commercial facilities, critical manufacturing, financial, government facilities, and transportation systems sector. The products see use on a global basis.

An attacker with low skill level would be able to leverage the vulnerabilities. Public exploits are available.

Dahua released updated firmware to mitigate these vulnerabilities.

Updated software can end up obtained from Dahua technical support or an authorized Dahua distributor.

In addition, Dahua released the following security notifications for users:
Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (March 6)
Cybersecurity Statement – March 6, 2017
Cybersecurity Vulnerability Update – March 8, 2017
Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (April 3)

China-based Dahua’s original notification specifies 11 affected models, but after initial testing, Dahua has identified additional series and models in the following security notification:
Security Notification DHCC-201703-01



Leave a Reply

You must be logged in to post a comment.