CVE-2017-6341
published 2017-02-27CVE-2017-6341: Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19…
PriorityP337medium5.9CVSS 3.0
AVNACHPRNUINSUCHINAN
EPSS
8.90%
94.6th percentile
Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dahuasecurity | camera_firmware | — | — |
| dahuasecurity | nvr_firmware | — | — |
| dahuasecurity | smartpss_firmware | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f8hh-555p-7c36: An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2017-6342 [HIGH] CWE-269 GHSA-f8hh-555p-7c36: An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3
An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117.
GHSA
GHSA-h4vw-6v48-gcvv: Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2017-6341 [HIGH] CWE-319 GHSA-h4vw-6v48-gcvv: Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3
Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/96456https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.htmlhttps://twitter.com/null_ku7/status/835649185168838657http://www.securityfocus.com/bid/96456https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.htmlhttps://twitter.com/null_ku7/status/835649185168838657
2017-02-27
Published