CVE-2017-9314 Auth bypass in NVR50XX, VR52XX, VR54XX, VR58XX
Attackers can bypass authentication on Dahua NVRs by forging JSON messages to gain unauthorized access to additional operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9314?
CVE-2017-9314 is a high-severity authentication bypass vulnerability in Dahua Technologies NVR50XX, VR52XX, VR54XX, VR58XX, published on 13 Nov 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of forging json message.
Weakness: CWE-287
Which versions are affected by CVE-2017-9314?
It affects 22 products.
Products include Dahuasecurity Nvr5208-4ks2 Firmware, Dahuasecurity Nvr5208-8p-4ks2 Firmware, Dahuasecurity Nvr5216-16p-4ks2 Firmware, Dahuasecurity Nvr5216-4ks2 Firmware, Dahuasecurity Nvr5216-8p-4ks2 Firmware, Dahuasecurity Nvr5224-24p-4ks2 Firmware and 16 more.
How do I fix CVE-2017-9314?
No fix has been published for CVE-2017-9314 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-9314 being exploited?
There is no known exploitation of CVE-2017-9314 in the wild and no public exploit code.
Sources
Also known as GHSA-43r4-72q9-7mv7.