critical10.0
CVE-2013-5754
The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it …
Impact
The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dahuasecurity | Dvr0404hd-A | All versions |
| Dahuasecurity | Dvr0404hd-L | All versions |
| Dahuasecurity | Dvr0404hd-S | All versions |
| Dahuasecurity | Dvr0404hd-U | All versions |
| Dahuasecurity | Dvr0404hf-A-E | All versions |
| Dahuasecurity | Dvr0404hf-Al-E | All versions |
| Dahuasecurity | Dvr0404hf-S-E | All versions |
| Dahuasecurity | Dvr0404hf-U-E | All versions |
| Dahuasecurity | Dvr0804 | All versions |
| Dahuasecurity | Dvr0804hd-L | All versions |
| Dahuasecurity | Dvr0804hd-S | All versions |
| Dahuasecurity | Dvr0804hf-A-E | All versions |