Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Use of Password Hash Instead of Password For Authentication (CVE-2017-7927)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502799);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2017-7927");
  script_xref(name:"ICSA", value:"17-124-02");

  script_name(english:"Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Use of Password Hash Instead of Password For Authentication (CVE-2017-7927)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A Use of Password Hash Instead of Password for Authentication issue
was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-
IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-
HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-
HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-
HCVR58A32S-S2 devices. The use of password hash instead of password
for authentication vulnerability was identified, which could allow a
malicious user to bypass authentication without obtaining the actual
password.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# script_set_attribute(attribute:"see_also", value:"http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/98312");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Dahua has released updated firmware to mitigate these vulnerabilities.

Updated software can be obtained from Dahua technical support or an authorized Dahua distributor.

In addition, Dahua released the following security notifications for users:

- Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (March 6)
- Cybersecurity Statement – March 6, 2017
- Cybersecurity Vulnerability Update – March 8, 2017
- Cyber Vulnerability Affecting Certain Dahua IP Cameras and Recorders (April 3)

Dahua’s original notification specifies 11 affected models, but after initial testing, Dahua has identified additional
series and models in the following security notification:

- Security Notification DHCC-201703-01");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7927");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(798, 836);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/05/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/DahuaSecurity");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/DahuaSecurity');

var asset = tenable_ot::assets::get(vendor:'DahuaSecurity');

var vuln_cpes = {
    "cpe:/o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"},
    "cpe:/o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-" :
        {"family" : "DahuaSecurityIPCameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);