DHCC-SA-202005-002:Security Advisory –Login authentication compatibility vulnerabilities found in some Dahua products
SA ID：DHCC-SA-202005-002
First Published：2020-5-11
Summary：
1．CVE-2019-9682：Login authentication compatibility vulnerability
Dahua devices use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.
Vulnerability Score（CVSS V3.0 http://www.first.org/cvss/specification-document）:
CVE-2020-9682
Base Score：8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Score：7.3 E:P/RL:O/RC:C
Affected Products & Fix Software：
The following product series and models are currently known to be affected：
|
Affected Model |
Affected Version |
Fix Software |
|
IPC-HX2XXX Series |
Versions which Build time before December,2019 |
DH_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313 General_IPC-HX25(8)XX-Molec_MultiLang_PN_V2.800.0000000.15.R.200313 DH_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313 General_IPC-HX25(8)XX-Molec_MultiLang_NP_V2.800.0000000.15.R.200313 |
|
IPC-HXXX5X4X Series
|
Versions which Build time before December,2019 |
DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319 DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319 DH_IPC-HX5XXX-Volt_MultiLang_PN_Stream3_V2.800.0000000.12.R.200319 DH_IPC-HX5XXX-Volt_MultiLang_NP_Stream3_V2.800.0000000.12.R.200319 |
|
IPC-HX5842H |
Versions which Build time before December,2019 |
DH_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324 DH_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324 General_IPC-HX8XXX-Nobel_MultiLang_PN_Stream3_V2.800.0000000.5.R.200324 General_IPC-HX8XXX-Nobel_MultiLang_NP_Stream3_V2.800.0000000.5.R.200324 |
|
IPC-HX7842H |
Versions which Build time before December,2019 |
DH_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324 DH_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324 General_IPC-HX8XXX-Nobel_MultiLang_NP_V2.800.0000000.5.R.200324 General_IPC-HX8XXX-Nobel_MultiLang_PN_V2.800.0000000.5.R.200324 |
|
NVR 5x Series |
Versions which Build time before December,2019 |
DH_NVR5XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319 |
|
NVR 4x Series |
Versions which Build time before December,2019 |
General_NVR4XXX-4KS2_MultiLang_V4.001.0000000.1.R.200319 |
|
SD6AL Series |
Versions which Build time before December,2019 |
DH_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331 DH_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331 General_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331 General_SD-Prometheus_Chn_PN_Stream3_V2.800.0000009.3.R.200331 DH_SD-Prometheus_MultiLang_NP_Stream3_V2.800.0000009.3.R.200331 General_SD-Prometheus_MultiLang_PN_Stream3_V2.800.0000009.3.R.200331 |
|
SD5A Series |
||
|
SD1A Series |
||
|
PTZ1A Series |
||
|
SD50/52C Series |
||
|
IPC-HDBW1320E-W |
Versions which Build time before December,2019 |
DH_IPC-Consumer-Zi-Themis_Eng_P_V2.400.0000000.18.R.20200426 DH_IPC-Consumer-Zi-Themis_EngSpn_N_V2.400.0000000.18.R.20200426 General_IPC-Consumer-Zi-Themis_Eng_N_V2.400.0000000.18.R.20200426 General_IPC-Consumer-Zi-Themis_Eng_P_V2.400.0000000.18.R.20200426 |
Note: Please login to the Web interface of the device to view Build time, which you can find on the Settings-System Information-Version Information page (setting-systeminfo-version).
Fix Software Download:
Please download the corresponding fix software or its newer version as listed in the above table from Dahua website, or contact Dahua local technical support to upgrade.
● Cloud Upgrade: Dahua products have the capability of cloud upgrade. Relevant repair versions can be obtained through cloud upgrade.
● Dahua Official Website: Mainland：https://www.dahuasecurity.com/support/downloadCenter
● Dahua Technical Support Personnel
Support Resources:
For any questions or concerns related to our products and solutions, please contact Dahua PSIRT at psirt@dahuatech.com.
We acknowledge the support of Bashis who discovered this vulnerability and reported to Dahua PSIRT.
