Dahua DHI-HCVR7216A-S3 Man-in-the-Middle Attack Vulnerability

Dahua DHI-HCVR7216A-S3 is a network DVR product from China Dahua Dahua. A man-in-the-middle attack vulnerability exists in Dahua DHI-HCVR7216A-S3 V3.210.0001.10 build 2016-06-06. As the Dahua DVR protocol running on TCP port 37777 is an unencrypted binary protocol. It allows an attacker to create...

CVE-2017-6432

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of...

CVE-2017-6432

The CVE-2017-6432 entry concerns Dahua DHI-HCVR7216A-S3 devices (firmware 3.210.0001.10, build 2016-06-06). The Dahua DVR protocol on TCP port 37777 is an unencrypted binary protocol; a Man-in-the-Middle can sniff and inject packets, enabling creation of fully privileged new users and capture of ...

PT-2017-17061

Name of the Vulnerable Software and Affected Versions Dahua DHI-HCVR7216A-S3 version 3.210.0001.10 Description An issue was discovered in the Dahua DVR Protocol, which operates on TCP Port 37777. This protocol is unencrypted and binary, allowing for a Man-in-the-Middle attack. Such an attack...

CVE-2017-6432: Cleartext Transmission of Sensitive Information

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of...

Dahua DHI-HCVR7216A-S3 Unauthorized Login Vulnerability

Dahua DHI-HCVR7216A-S3 is a network DVR product from China Dahua Dahua. A security vulnerability exists in the web interface in the Dahua DHI-HCVR7216A-S3 device. A remote attacker can exploit the vulnerability to submit a special request for unauthorized access to the device...

Design/Logic Flaw

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...

CVE-2017-6343

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the...

Design/Logic Flaw

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the...

CVE-2017-6341

Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows...

CVE-2017-6342

Affected software/hardware: Dahua DHI-HCVR7216A-S3 devices (NVR firmware 3.210.0001.10, camera firmware 2.400.0000.28.R, SmartPSS 1.16.1). Vulnerability summary: When SmartPSS is launched and on the login screen, the background process logs in as admin, enabling sniffing of sensitive information ...

CVE-2017-6343

The vulnerability CVE-2017-6343 affects Dahua DHI-HCVR7216A-S3 devices and is realized via the web interface, enabling remote authentication bypass by using knowledge of the MD5 Admin Hash to gain login access without the password. Affected components include NVR firmware 3.210.0001.10, Camera fi...

CVE-2017-6342

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...

CVE-2017-6341

CVE-2017-6341 affects Dahua DHI-HCVR7216A-S3 devices (NVR 3.210.0001.10, Camera 2.400.0000.28.R, SmartPSS 1.16.1). The web/mobile/desktop interfaces return cleartext passwords in responses, enabling remote attackers to obtain sensitive data by sniffing the network. Related entries describe additi...

CVE-2017-6343

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the...

PT-2017-17008

Name of the Vulnerable Software and Affected Versions Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 Dahua DHI-HCVR7216A-S3 devices with Camera Firmware 2.400.0000.28.R Dahua DHI-HCVR7216A-S3 devices with SmartPSS Software 1.16.1 Description The issue allows remote attackers to...

PT-2017-17010

Name of the Vulnerable Software and Affected Versions Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 Dahua DHI-HCVR7216A-S3 devices with Camera Firmware 2.400.0000.28.R Dahua DHI-HCVR7216A-S3 devices with SmartPSS Software 1.16.1 Description The issue allows remote attackers to...

CVE-2017-6343: Improper Authentication

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the...

CVE-2017-6342: Improper Privilege Management

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...

CVE-2017-6341: Cleartext Transmission of Sensitive Information

Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows...