CVE-2017-7253 Auth bypass in n/a
Attackers can use default low-privilege credentials to list users and subsequently log in as admin, gaining full control of the IP camera.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7253?
CVE-2017-7253 is a high-severity authentication bypass vulnerability in n/a, published on 30 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the first JSON object encountered has a "Component error: login challenge!" message. The second JSON object encountered has a result indicating a successful admin login.
Weakness: CWE-922
Which versions are affected by CVE-2017-7253?
It affects 1 product.
Products include Dahuasecurity Ip Camera Firmware.
How do I fix CVE-2017-7253?
No fix has been published for CVE-2017-7253 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-7253 being exploited?
There is no known exploitation of CVE-2017-7253 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mqm7-jpjf-v8cm.