jvndb-2024-000007
Vulnerability from jvndb
Published
2024-01-18 13:43
Modified
2024-07-11 16:10
Severity ?
8.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple Dahua Technology products vulnerable to authentication bypass
Details
Multiple products provided by Dahua Technology contain an authentication bypass vulnerability (CWE-287). Mitsui Bussan Secure Directions, Inc. reported the vulnerability existed in "DHI-ASI7213Y-V3-T1" to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN https://jvn.jp/en/jp/JVN83655695/index.html
CVE https://www.cve.org/CVERecord?id=CVE-2021-33044
NVD https://nvd.nist.gov/vuln/detail/CVE-2021-33044
Improper Authentication(CWE-287) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
Dahua Technology Co., LtdDHI-ASI7213Y-V3-T1
Dahua Technology Co., LtdIPC-HUM7XXX
Dahua Technology Co., LtdIPC-HX1XXX
Dahua Technology Co., LtdIPC-HX2XXX
Dahua Technology Co., LtdIPC-HX3XXX
Dahua Technology Co., LtdIPC-HX5(4)(3)XXX
Dahua Technology Co., LtdIPC-HX5XXX
Dahua Technology Co., LtdIPC-HX8XXX
Dahua Technology Co., LtdPTZ Dome Camera SD1A1
Dahua Technology Co., LtdPTZ Dome Camera SD22
Dahua Technology Co., LtdPTZ Dome Camera SD49
Dahua Technology Co., LtdPTZ Dome Camera SD50
Dahua Technology Co., LtdPTZ Dome Camera SD52C
Dahua Technology Co., LtdPTZ Dome Camera SD6AL
Dahua Technology Co., LtdThermal TPC-BF1241
Dahua Technology Co., LtdThermal TPC-BF2221
Dahua Technology Co., LtdThermal TPC-BF5XXX
Dahua Technology Co., LtdThermal TPC-SD2221
Dahua Technology Co., LtdThermal TPC-PT8X21B
Dahua Technology Co., LtdThermal TPC-SD8X21
Dahua Technology Co., LtdVTH542XH
Dahua Technology Co., LtdVTO65XXX
Dahua Technology Co., LtdVTO75X95X
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000007.html",
  "dc:date": "2024-07-11T16:10+09:00",
  "dcterms:issued": "2024-01-18T13:43+09:00",
  "dcterms:modified": "2024-07-11T16:10+09:00",
  "description": "Multiple products provided by Dahua Technology contain an authentication bypass vulnerability (CWE-287).\r\n\r\nMitsui Bussan Secure Directions, Inc. reported the vulnerability existed in \"DHI-ASI7213Y-V3-T1\" to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000007.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:dahuasecurity:dhi-asi7213y-v3-t1_firmware",
      "@product": "DHI-ASI7213Y-V3-T1",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hum7xxx_firmware",
      "@product": "IPC-HUM7XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx1xxx_firmware",
      "@product": "IPC-HX1XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx2xxx_firmware",
      "@product": "IPC-HX2XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx3xxx_firmware",
      "@product": "IPC-HX3XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx5%284%29%283%29xxx_firmware",
      "@product": "IPC-HX5(4)(3)XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx5xxx_firmware",
      "@product": "IPC-HX5XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx8xxx_firmware",
      "@product": "IPC-HX8XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd1a1_firmware",
      "@product": "PTZ Dome Camera SD1A1",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd22_firmware",
      "@product": "PTZ Dome Camera SD22",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd49_firmware",
      "@product": "PTZ Dome Camera SD49",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd50_firmware",
      "@product": "PTZ Dome Camera SD50",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd52c_firmware",
      "@product": "PTZ Dome Camera SD52C",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd6al_firmware",
      "@product": "PTZ Dome Camera SD6AL",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf1241_firmware",
      "@product": "Thermal TPC-BF1241",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf2221_firmware",
      "@product": "Thermal TPC-BF2221",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf5xxx_firmware",
      "@product": "Thermal TPC-BF5XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd2221_firmware",
      "@product": "Thermal TPC-SD2221",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd8x21b_firmware",
      "@product": "Thermal TPC-PT8X21B",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd8x21_firmware",
      "@product": "Thermal TPC-SD8X21",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vth-542xh_firmware",
      "@product": "VTH542XH",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vto-65xxx_firmware",
      "@product": "VTO65XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vto-75x95x_firmware",
      "@product": "VTO75X95X",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "7.6",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
      "@version": "2.0"
    },
    {
      "@score": "8.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2024-000007",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN83655695/index.html",
      "@id": "JVN#83655695",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2021-33044",
      "@id": "CVE-2021-33044",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-33044",
      "@id": "CVE-2021-33044",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "Multiple Dahua Technology products vulnerable to authentication bypass"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.