CVE-2017-6341 - OpenCVE

Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dahuasecurity	Camera Firmware Dhi-hcvr7216a-s3 Nvr Firmware Smartpss Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:::::::*
	cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:::::::*
	cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:::::::*

cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/96456
https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html
https://twitter.com/null_ku7/status/835649185168838657

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-02-27T07:25:00

Updated: 2024-08-05T15:25:49.189Z

Reserved: 2017-02-26T00:00:00

Link: CVE-2017-6341

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2017-02-27T07:59:00.380

Modified: 2019-10-03T00:03:26.223

Link: CVE-2017-6341

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-02-27T00:00:00", "descriptions": [{"lang": "en", "value": "Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-03-01T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://twitter.com/null_ku7/status/835649185168838657"}, {"tags": ["x_refsource_MISC"], "url": "https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html"}, {"name": "96456", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96456"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-6341", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://twitter.com/null_ku7/status/835649185168838657", "refsource": "MISC", "url": "https://twitter.com/null_ku7/status/835649185168838657"}, {"name": "https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html", "refsource": "MISC", "url": "https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html"}, {"name": "96456", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96456"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T15:25:49.189Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/null_ku7/status/835649185168838657"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html"}, {"name": "96456", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/96456"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-6341", "datePublished": "2017-02-27T07:25:00", "dateReserved": "2017-02-26T00:00:00", "dateUpdated": "2024-08-05T15:25:49.189Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:*:*:*:*:*:*:*", "matchCriteriaId": "5F6BC430-D09D-4F25-B795-E24C294A924C", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:*:*:*:*:*:*:*", "matchCriteriaId": "A9D785EA-C49B-41F4-8810-EEDEF861F54B", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:*:*:*:*:*:*:*", "matchCriteriaId": "7E3E1C39-FF68-4116-94D5-E9CB1E36FB98", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DF491B9-DB4C-41D7-ADC7-D5E45CC3724E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117."}, {"lang": "es", "value": "Dispositivos Dahua DHI-HCVR7216A-S3 con NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29 y SmartPSS Software 1.16.1 2017-01-19 envia contrase\u00f1as en texto plano en respuesta a las solicitudes de la p\u00e1gina web, aplicaciones m\u00f3viles e interfaces de aplicaciones de escritorio, lo que permite a atacantes remotos obtener informaci\u00f3n sensible rastreando la red, una vulnerabilidad diferente a CVE-2013-6117."}], "id": "CVE-2017-6341", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-27T07:59:00.380", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/96456"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/null_ku7/status/835649185168838657"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}