CVE-2020-9499 Memory corruption in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series
Authenticated attackers can cause denial of service on Dahua IP cameras and NVRs by sending a specific DDNS test command that triggers a buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9499?
CVE-2020-9499 is a high-severity memory corruption vulnerability in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series, published on 9 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
Weakness: CWE-120
Which versions are affected by CVE-2020-9499?
It affects 19 products.
Products include Dahuasecurity Ipc-Hx2xxx Firmware, Dahuasecurity Ipc-Hx5842h Firmware, Dahuasecurity Ipc-Hx7842h Firmware, Dahuasecurity Ipc-Hxxx5x4x Firmware, Dahuasecurity N42b1p Firmware, Dahuasecurity N42b2p Firmware and 13 more.
How do I fix CVE-2020-9499?
No fix has been published for CVE-2020-9499 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-9499 being exploited?
There is no known exploitation of CVE-2020-9499 in the wild and no public exploit code.
Other vulnerabilities in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series
Sources
Also known as GHSA-3678-jj2q-4554.