medium5.3
CVE-2022-45424
Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key.
Impact
Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dahuasecurity | Dss Express | Versions 7.002.1760000.2, 8.0.2, 8.0.4, 8.1, 8.1.1 |
| Dahuasecurity | Dss Professional | Versions 7.002.1760000.2, 8.0.2, 8.0.4, 8.1, 8.1.1 |
| Dahuasecurity | Dhi-Dss7016d-S2 Firmware | Versions 1.001.0000001.2, 8.0.2, 8.0.4, 8.1 |
| Dahuasecurity | Dhi-Dss7016dr-S2 Firmware | Versions 1.001.0000001.2, 8.0.2, 8.0.4, 8.1 |
| Dahuasecurity | Dhi-Dss4004-S2 Firmware | Versions 1.001.0000001.2, 8.0.2, 8.0.4, 8.1 |