CVE-2019-9682 Weak cryptography in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HDBW1320E-W
Attackers can intercept network packets to compromise devices if users enable the optional weak security login mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9682?
CVE-2019-9682 is a high-severity vulnerability in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HDBW1320E-W, published on 13 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.
Weakness: CWE-276
Which versions are affected by CVE-2019-9682?
It affects 20 products.
Products include Dahuasecurity Ipc-Hdbw1320e-W Firmware, Dahuasecurity Ipc-Hx2xxx Firmware, Dahuasecurity Ipc-Hx5842h Firmware, Dahuasecurity Ipc-Hx7842h Firmware, Dahuasecurity Ipc-Hxxx5x4x Firmware, Dahuasecurity N42b1p Firmware and 14 more.
How do I fix CVE-2019-9682?
No fix has been published for CVE-2019-9682 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-9682 being exploited?
There is no known exploitation of CVE-2019-9682 in the wild and no public exploit code.
Other vulnerabilities in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HDBW1320E-W
Sources
Also known as GHSA-26hg-8v7r-7fj4.