NetSight
IP …
medium5.3

CVE-2019-9681

Online upgrade information in some firmware packages of Dahua products is not encrypted.

Impact

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.

Affected products

VendorProductAffected versions
DahuasecurityIpc-Hdw1x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hfw1x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hdw2x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hfw2x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hdw4x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hfw4x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hdbw4x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hdw5x2x Firmware
before 2019-08-18
DahuasecurityIpc-Hfw5x2x Firmware
before 2019-08-18

Weakness classification

CWE-311

References