critical10.0Public exploit code
CVE-2013-3612
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)2013-11-18 · webapps · hardware
Impact
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dahuasecurity | Dvr0404hd-A | All versions |
| Dahuasecurity | Dvr0404hd-L | All versions |
| Dahuasecurity | Dvr0404hd-S | All versions |
| Dahuasecurity | Dvr0404hd-U | All versions |
| Dahuasecurity | Dvr0404hf-A-E | All versions |
| Dahuasecurity | Dvr0404hf-Al-E | All versions |
| Dahuasecurity | Dvr0404hf-S-E | All versions |
| Dahuasecurity | Dvr0404hf-U-E | All versions |
| Dahuasecurity | Dvr0804 | All versions |
| Dahuasecurity | Dvr0804hd-L | All versions |
| Dahuasecurity | Dvr0804hd-S | All versions |
| Dahuasecurity | Dvr0804hf-A-E | All versions |