CVE-2017-6342 Auth bypass in n/a
Dahua SmartPSS automatically logs in as admin on the login screen, allowing attackers to bypass authentication and sniff sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6342?
CVE-2017-6342 is a critical authentication bypass vulnerability in n/a, published on 27 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117.
Weakness: CWE-269
Which versions are affected by CVE-2017-6342?
It affects 3 products.
Products include Dahuasecurity Camera Firmware, Dahuasecurity Nvr Firmware, Dahuasecurity Smartpss Firmware.
How do I fix CVE-2017-6342?
No fix has been published for CVE-2017-6342 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-6342 being exploited?
There is no known exploitation of CVE-2017-6342 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f8hh-555p-7c36.