high7.8Public exploit code
CVE-2013-3613
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)2013-11-18 · webapps · hardware
Impact
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dahuasecurity | Dvr0404hd-A | All versions |
| Dahuasecurity | Dvr0404hd-L | All versions |
| Dahuasecurity | Dvr0404hd-S | All versions |
| Dahuasecurity | Dvr0404hd-U | All versions |
| Dahuasecurity | Dvr0404hf-A-E | All versions |
| Dahuasecurity | Dvr0404hf-Al-E | All versions |
| Dahuasecurity | Dvr0404hf-S-E | All versions |
| Dahuasecurity | Dvr0404hf-U-E | All versions |
| Dahuasecurity | Dvr0804 | All versions |
| Dahuasecurity | Dvr0804hd-L | All versions |
| Dahuasecurity | Dvr0804hd-S | All versions |
| Dahuasecurity | Dvr0804hf-A-E | All versions |