Dahuasecurity.com uses cookies and similar technologies. Dahua uses functional cookies to ensure that its websites operate properly and analytical cookies to make your user experience optimal. Third-party cookies may collect data outside our websites as well. By clicking on " Agree" or by continuing to use this website, you give consent for the setting of cookies and the processing of personal data involved. More information on our cookie statement.

Security Advisory –Login authentication compatibility vulnerabilities found in some Dahua products

1106

SA ID:DHCC-SA-202005-002


First Published:2020-5-11


Summary:


1.CVE-2019-9682:Login authentication compatibility vulnerability


Dahua devices use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.


Vulnerability Score(CVSS V3.0 http://www.first.org/cvss/specification-document):


CVE-2020-9682


Base Score:8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Score:7.3 E:P/RL:O/RC:C


Affected Products & Fix Software:


The following product series and models are currently known to be affected:

Affected Model

Affected Version

Fix Software

IPC-HX2XXX Series

Versions which Build time before December,2019

DH_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313

General_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313

DH_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313

General_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313

IPC-HXXX5X4X Series


Versions which Build time before December,2019

DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319

DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319

IPC-HX5842H

Versions which Build time before December,2019

DH_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324

DH_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324

IPC-HX7842H

Versions which Build time before December,2019

DH_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324

DH_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324

General_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324

NVR 5x Series

Versions which Build time before December,2019

DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_Chn_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR5XXX-4KS2_Eng_V4.001.0000000.1.R.200319
DH_NVR5XXX-4KS2_Chn_V4.001.0000000.1.R.200319

NVR 4x Series

Versions which Build time before December,2019

General_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
DH_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319
General_NVR4XXX-4KS2_Chn_V4.001.0000000.1.R.200319
General_NVR4XXX-4KS2_Eng_V4.001.0000000.1.R.200319
DH_NVR4XXX-4KS2_Chn_V4.001.0000000.1.R.200319

SD6AL Series

Versions which Build time before December,2019

DH_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331

DH_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331

DH_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331

General_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331

SD5A Series

SD1A Series

PTZ1A Series

SD50/52C Series

IPC-HDBW1320E-W

Versions which Build time before December,2019

DH_IPC-Consumer-Zi-Themis_Eng_P_V2.400.0000000.18.R.20200426

DH_IPC-Consumer-Zi-Themis_EngSpn_N_V2.400.0000000.18.R.20200426

General_IPC-Consumer-Zi-Themis_Eng_N_V2.400.0000000.18.R.20200426

General_IPC-Consumer-Zi-Themis_Eng_P_V2.400.0000000.18.R.20200426

Note: Please login to the Web interface of the device to view Build time, which you can find on the Settings-System Information-Version Information page (setting-systeminfo-version).


Fix Software Download:


Please download the corresponding fix software or its newer version as listed in the above table from Dahua website, or contact Dahua local technical support to upgrade.

● Cloud Upgrade: Dahua products have the capability of cloud upgrade. Relevant repair versions can be obtained through cloud upgrade.

● Dahua Official Website: Mainland:https://www.dahuasecurity.com/support/downloadCenter

● Dahua Technical Support Personnel


Support Resources:


For any questions or concerns related to our products and solutions, please contact Dahua DHCC at cybersecurity@dahuatech.com.

We acknowledge the support of Bashis who discovered this vulnerability and reported to DHCC.