CVE-2020-9500 Denial of service in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series
Authenticated attackers can crash Dahua security devices by sending specific log query commands, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9500?
CVE-2020-9500 is a medium-severity denial of service vulnerability in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series, published on 9 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down.
Which versions are affected by CVE-2020-9500?
It affects 19 products.
Products include Dahuasecurity Ipc-Hx2xxx Firmware, Dahuasecurity Ipc-Hx5842h Firmware, Dahuasecurity Ipc-Hx7842h Firmware, Dahuasecurity Ipc-Hxxx5x4x Firmware, Dahuasecurity N42b1p Firmware, Dahuasecurity N42b2p Firmware and 13 more.
How do I fix CVE-2020-9500?
No fix has been published for CVE-2020-9500 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-9500 being exploited?
There is no known exploitation of CVE-2020-9500 in the wild and no public exploit code.
Other vulnerabilities in IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series
Sources
Also known as GHSA-wc34-c3wp-3988.