CVE-2022-45425 Hardcoded credentials in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2

What is CVE-2022-45425?

CVE-2022-45425 is a high-severity vulnerability in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.

Weakness: CWE-798

Which versions are affected by CVE-2022-45425?

It affects 5 products.

Products include Dahuasecurity Dhi-Dss4004-S2 Firmware, Dahuasecurity Dhi-Dss7016d-S2 Firmware, Dahuasecurity Dhi-Dss7016dr-S2 Firmware, Dahuasecurity Dss Express, Dahuasecurity Dss Professional.

How do I fix CVE-2022-45425?

No fix has been published for CVE-2022-45425 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-45425 being exploited?

There is no known exploitation of CVE-2022-45425 in the wild and no public exploit code.

Other vulnerabilities in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2

• CVE-2022-45423 Information disclosure in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 High 7.5
• CVE-2022-45429 Server-side request forgery in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 High 7.5
• CVE-2022-45431 Auth bypass in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 High 7.5
• CVE-2022-45427 File upload in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 High 7.2
• CVE-2022-45426 Path traversal in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7qrc-wm75-hvh3.