CVE-2020-9501 Information disclosure in Web P2P control,P2P plartform server,client tools
Attackers can leak Cloud Keys from Dahua Web P2P control to impersonate clients and consume platform resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9501?
CVE-2020-9501 is a medium-severity vulnerability in Web P2P control,P2P plartform server,client tools, published on 13 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
Which versions are affected by CVE-2020-9501?
It affects 1 product.
Products include Dahuasecurity Web P2p.
How do I fix CVE-2020-9501?
No fix has been published for CVE-2020-9501 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9501 being exploited?
There is no known exploitation of CVE-2020-9501 in the wild and no public exploit code.
Sources
Also known as GHSA-v4j7-h442-4c52.