CVE-2017-9316 Auth bypass in IPC-HDW4300S\NVR11HS\IPC-HFW4X00\IPC-HDW4X00\IPC-HDBW4X00\IPC-HF5X00\IPC-HFW5X00\IPC-HDW5X00\IPC-HDBW5X00\NVR11HS
An authentication bypass in Dahua IP cameras allows attackers to bypass firmware upgrade checks via a debug function, potentially compromising device integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9316?
CVE-2017-9316 is a medium-severity authentication bypass vulnerability in Dahua Technologies IPC-HDW4300S\NVR11HS\IPC-HFW4X00\IPC-HDW4X00\IPC-HDBW4X00\IPC-HF5X00\IPC-HFW5X00\IPC-HDW5X00\IPC-HDBW5X00\NVR11HS, published on 27 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.
Weakness: CWE-287
Which versions are affected by CVE-2017-9316?
It affects 9 products.
Products include Dahuasecurity Ipc-Hdbw4x00 Firmware, Dahuasecurity Ipc-Hdbw5x00 Firmware, Dahuasecurity Ipc-Hdw4300s Firmware, Dahuasecurity Ipc-Hdw4x00 Firmware, Dahuasecurity Ipc-Hdw5x00 Firmware, Dahuasecurity Ipc-Hf5x00 Firmware and 3 more.
How do I fix CVE-2017-9316?
No fix has been published for CVE-2017-9316 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-9316 being exploited?
There is no known exploitation of CVE-2017-9316 in the wild and no public exploit code.
Sources
Also known as GHSA-mgmj-4r54-qfxp.