Hardcoded credentials

Dahua DVR appliances have a hardcoded password for 1 the root account and 2 an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving a ActiveX, b a standalone client, or c unknown other vectors...

Design/Logic Flaw

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port...

CVE-2013-3613

CVE-2013-3613 affects Dahua DVR appliances. UPnP requests from untrusted addresses are not properly restricted, enabling remote attackers to obtain access via vectors involving a replay attack against the TELNET port (administrative service on TCP 37777 by default). Root cause is inadequate acces...

CVE-2013-3614

Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-3615

The CVE-2013-3615 vulnerability affects Dahua DVR appliances (and rebranded variants), where a password-hash algorithm uses a short hash length, enabling context-dependent attackers to brute-force and recover cleartext passwords. This weakness resides in the device’s credential protection mechani...

CVE-2013-5754

CVE-2013-5754 affects Dahua DVR appliances. The authorization implementation accepts a hash string representing the current date as a master password, enabling remote attackers to obtain administrative access and change the administrator password via requests over ActiveX, a standalone client, or...

CVE-2013-3612

Dahua DVR appliances have a hardcoded password for 1 the root account and 2 an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving a ActiveX, b a standalone client, or c unknown other vectors...

CVE-2013-5754

The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving 1 ActiveX, 2 a...

CVE-2013-3613

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port...

CVE-2013-3612

CVE-2013-3612 affects Dahua DVR appliances, where a hardcoded password exists for the root account and an unspecified backdoor account. This facilitates administrative access by remote attackers via authorization requests using (a) ActiveX, (b) a standalone client, or (c) other vectors. The Conne...

CVE-2013-3615

Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack...

CVE-2013-3614

Dahua DVR appliances are affected by CVE-2013-3614: the maximum password length is too small, enabling easier remote brute‑force access. Documents describe an authentication-related weakness impacting Dahua DVRs, including the service on TCP port 37777 and the potential for password‑related compr...

CVE-2013-3613: Improper Authentication

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port...

PT-2013-4517

Name of the Vulnerable Software and Affected Versions Dahua DVR appliances affected versions not specified Description The issue concerns hardcoded passwords for the root account and an unspecified backdoor account. This makes it easier for remote attackers to gain administrative access. Attacker...

PT-2013-5767

Name of the Vulnerable Software and Affected Versions Dahua DVR appliances affected versions not specified Description The issue concerns the authorization mechanism in Dahua DVR appliances, where a hash string representing the current date can be used as a master password. This weakness allows...

CVE-2013-3614: Undefined Security Weakness

Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-3612: Undefined Security Weakness

Dahua DVR appliances have a hardcoded password for 1 the root account and 2 an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving a ActiveX, b a standalone client, or c unknown other vectors...

CVE-2013-5754: Undefined Security Weakness

The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving 1 ActiveX, 2 a...

PT-2013-4518

Name of the Vulnerable Software and Affected Versions Dahua DVR appliances affected versions not specified Description The issue is related to the improper restriction of UPnP requests, making it easier for remote attackers to gain access. This can be achieved through vectors involving a replay...

PT-2013-4520

Name of the Vulnerable Software and Affected Versions Dahua DVR appliances affected versions not specified Description The issue concerns a password-hash algorithm used by Dahua DVR appliances, which has a short hash length. This makes it easier for attackers to discover cleartext passwords via a...