critical9.8
CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities.
Impact
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dahuasecurity | Sd6al Firmware | before 2019-12 |
| Dahuasecurity | Sd5a Firmware | before 2019-12 |
| Dahuasecurity | Sd1a Firmware | before 2019-12 |
| Dahuasecurity | Ptz1a Firmware | before 2019-12 |
| Dahuasecurity | Sd50 Firmware | before 2019-12 |
| Dahuasecurity | Sd52c Firmware | before 2019-12 |
| Dahuasecurity | Ipc-Hx5842h Firmware | before 2019-12 |
| Dahuasecurity | Ipc-Hx7842h Firmware | before 2019-12 |
| Dahuasecurity | Ipc-Hx2xxx Firmware | before 2019-12 |
| Dahuasecurity | Ipc-Hxxx5x4x Firmware | before 2019-12 |
| Dahuasecurity | N42b1p Firmware | before 2019-12 |
| Dahuasecurity | N42b2p Firmware | before 2019-12 |