Dahuasecurity.com utiliza cookies y tecnologías similares. Dahua utiliza cookies funcionales para garantizar que sus sitios web funcionen correctamente y cookies analíticas para que su experiencia de usuario sea óptima. Las cookies de terceros también pueden recopilar datos fuera de nuestros sitios web. Al hacer clic en & quot; De acuerdo& quot; o al continuar utilizando este sitio web, usted da su consentimiento para la configuración de cookies y el procesamiento de los datos personales involucrados. Más información sobre nuestra declaración de cookies

Security Advisory –Denial of Service vulnerability exists in some Dahua products

782

SA ID:DHCC-SA-202004-001


First Published:2020-4-7


Summary:


1.CVE-2020-9499:Buffer Overflow vulnerability

Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.


2. CVE-2020-9500:Denial of Service vulnerability

Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down.


Vulnerability Score(CVSS V3.0 http://www.first.org/cvss/specification-document):


1.CVE-2020-9499

Base Score:4.9(AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Temporal Score:4.4(E:P/RL:O/RC:C)


2. CVE-2020-9500

Base Score:4.9(AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Temporal Score:4.4(E:P/RL:O/RC:C)


Affected Products & Fix Software:


The following product series and models are currently known to be affected:

Affected Model

Affected Version

Fix Software

IPC-HX2XXX Series

Versions which Build time before December,2019

DH_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313

General_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313

DH_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313

General_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313

IPC-HXXX5X4X Series


Versions which Build time before December,2019

DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319

IPC-HX5842H

Versions which Build time before December,2019

DH_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324

DH_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324

IPC-HX7842H

Versions which Build time before December,2019

DH_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324

DH_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324

NVR 5x Series

Versions which Build time before December,2019

DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_Chn_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_Eng_V4.001.0000000.1.R.200319
DH_NVR5XXX-4KS2_Chn_V4.001.0000000.1.R.200319

NVR 4x Series

Versions which Build time before December,2019

General_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR4XXX-4KS2_Chn_V4.001.0000000.1.R.200319
General_NVR4XXX-4KS2_Eng_V4.001.0000000.1.R.200319
DH_NVR4XXX-4KS2_Chn_V4.001.0000000.1.R.200319

SD6AL Series

Versions which Build time before December,2019

DH_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331

DH_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331

DH_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331

SD5A Series

SD1A Series

PTZ1A Series

SD50/52C Series

Note: Please login to the Web interface of the device to view Build time, which you can find on the Settings-System Information-Version Information page (setting-systeminfo-version).


Fix Software Download:


Please download the corresponding fix software or its newer version as listed in the above table from Dahua website, or contact Dahua local technical support to upgrade.


Cloud Upgrade: Dahua products have the capability of cloud upgrade. Relevant repair versions can be obtained through cloud upgrade.


Dahua Official Website: Mainland:https://www.dahuasecurity.com/support/downloadCenter


Dahua Technical Support Personnel


Support Resources:


For any questions or concerns related to our products and solutions, please contact Dahua DHCC at cybersecurity@dahuatech.com