CVE-2024-39950 Other in NVR4XXX and IPC-HX8XXX
Attackers can send crafted packets to Dahua NVR and IPC devices to trigger device initialization, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39950?
CVE-2024-39950 is a high-severity vulnerability in Dahua NVR4XXX and IPC-HX8XXX, published on 31 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
Which versions are affected by CVE-2024-39950?
It affects 58 products.
Products include Dahuasecurity Ipc-Hfs8449g-Z7-Led Firmware, Dahuasecurity Ipc-Hfs8849g-Z3-Led Firmware, Dahuasecurity Nvr4104-4ks2\/L Firmware, Dahuasecurity Nvr4104-4ks3 Firmware, Dahuasecurity Nvr4104-P-4ks2\/L Firmware, Dahuasecurity Nvr4104-P-4ks3\(960g\) Firmware and 52 more.
How do I fix CVE-2024-39950?
No fix has been published for CVE-2024-39950 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39950 being exploited?
There is no known exploitation of CVE-2024-39950 in the wild and no public exploit code.
Other vulnerabilities in Dahua NVR4XXX and IPC-HX8XXX
Sources
Also known as GHSA-x56v-vwr6-4gfg.