CVE-2023-51629

CWE-259CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
8.8HIGH
EPSS
0.3%
top 50.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dlink Dcs-8300lhv2 FirmwareD-link Dcs-8300lhv2
Timeline
PublishedMay 3

Description

D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the ONVIF API. The issue results from the use of a hardcoded PIN. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21492.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5d-link/dcs-8300lhv21.06.01

🔴Vulnerability Details

2
GHSA
GHSA-cw65-c3g7-7rw3: D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability↗2024-05-03
▶
CVEList
D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability↗2024-05-03
▶
CVE-2023-51629 (HIGH CVSS 8.8) | D-Link DCS-8300LHV2 ONVIF Hardcoded | cvebase.io