Search
Find a vulnerability
Search criteria
6 vulnerabilities found for ipc-hf8xxx_firmware by dahuasecurity
CVE-2024-39950 (GCVE-0-2024-39950)
Vulnerability from nvd – Published: 2024-07-31 03:45 – Updated: 2025-09-30 03:39
VLAI
EPSS
VEX
Summary
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-31 15:04 UTC
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dahua | NVR4XXX and IPC-HX8XXX |
Affected:
NVR4XXX and IPC-HX8XXX Versions which Build time before 2024/1/22
|
|
| dahuasecurity | nvr4832-i |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hf8xxx_firmware |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hfw8xxx |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:* |
Date Public
2024-07-31 03:42
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nvr4832-i",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hf8xxx_firmware",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hfw8xxx",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T15:04:00.945009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T19:12:46.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NVR4XXX and IPC-HX8XXX",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "NVR4XXX and IPC-HX8XXX Versions which Build time\u00a0before 2024/1/22"
}
]
}
],
"datePublic": "2024-07-31T03:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization."
}
],
"value": "A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T03:39:46.118Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"url": "https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2024-39950",
"datePublished": "2024-07-31T03:45:12.977Z",
"dateReserved": "2024-07-05T03:08:11.185Z",
"dateUpdated": "2025-09-30T03:39:46.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39944 (GCVE-0-2024-39944)
Vulnerability from nvd – Published: 2024-07-31 03:13 – Updated: 2025-09-30 03:33
VLAI
EPSS
VEX
Summary
A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-31 15:24 UTC
CWE
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dahua | IPC-HX8XXX and NVR4XXX |
Affected:
IPC-HX8XXX and NVR4XXX Versions which Build time before 2024/2/2
|
|
| dahuasecurity | nvr4832-i |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hf8xxx_firmware |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hfw8xxx |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:* |
Date Public
2024-07-31 03:09
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nvr4832-i",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hf8xxx_firmware",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hfw8xxx",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T15:24:11.982486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T19:10:56.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPC-HX8XXX and NVR4XXX",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "IPC-HX8XXX and NVR4XXX Versions which Build time before 2024/2/2"
}
]
}
],
"datePublic": "2024-07-31T03:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: var(--wht);\"\u003eA vulnerability has been found in Dahua products.Attackers\ncan send carefully crafted data packets to the interface with vulnerabilities,\ncausing the device to crash.\u003c/span\u003e\u003cbr\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "A vulnerability has been found in Dahua products.Attackers\ncan send carefully crafted data packets to the interface with vulnerabilities,\ncausing the device to crash."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T03:33:00.394Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"url": "https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2024-39944",
"datePublished": "2024-07-31T03:13:03.509Z",
"dateReserved": "2024-07-05T03:08:11.184Z",
"dateUpdated": "2025-09-30T03:33:00.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-9315 (GCVE-0-2017-9315)
Vulnerability from nvd – Published: 2017-11-28 19:00 – Updated: 2024-09-17 02:31
VLAI
EPSS
VEX
Summary
Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker.
Severity
No CVSS data available.
CWE
- risk of sensitive information leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| http://www.dahuasecurity.com/annoucementsingle/se… | x_refsource_CONFIRM |
Impacted products
1 product
Date Public
2017-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:02:44.242Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Dahua IP Camera and IP PTZ IPC-HFW1XXX, IPC-HDW1XXX, IPC-HDBW1XXX, IPC-HFW2XXX, IPC-HDW2XXX, IPC-HDBW2XXX, IPC-HFW4XXX, IPC-HDW4XXX, IPC-HDBW4XXX, IPC-HF5XXX, IPC-HFW5XXX, IPC-HDW5XXX, IPC-HDBW5XXX, IPC-HF8XXX, IPC-HFW8XXX, IPC-HDBW8XXX, IPC-EBW8XXX, IPC-PFW8xxx, IPC-PDBW8xxx, IPC-HUM8xxx, PSD8xxxx, DH-SD2XXXXX, DH-SD4XXXXX, DH-SD5XXXXX, DH-SD6XXXXX",
"vendor": "Dahua Technologies",
"versions": [
{
"status": "affected",
"version": "Versions Build between 2015/07 and 2017/03"
}
]
}
],
"datePublic": "2017-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "risk of sensitive information leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-28T18:57:01.000Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@dahuatech.com",
"DATE_PUBLIC": "2017-11-10T00:00:00",
"ID": "CVE-2017-9315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Dahua IP Camera and IP PTZ IPC-HFW1XXX, IPC-HDW1XXX, IPC-HDBW1XXX, IPC-HFW2XXX, IPC-HDW2XXX, IPC-HDBW2XXX, IPC-HFW4XXX, IPC-HDW4XXX, IPC-HDBW4XXX, IPC-HF5XXX, IPC-HFW5XXX, IPC-HDW5XXX, IPC-HDBW5XXX, IPC-HF8XXX, IPC-HFW8XXX, IPC-HDBW8XXX, IPC-EBW8XXX, IPC-PFW8xxx, IPC-PDBW8xxx, IPC-HUM8xxx, PSD8xxxx, DH-SD2XXXXX, DH-SD4XXXXX, DH-SD5XXXXX, DH-SD6XXXXX",
"version": {
"version_data": [
{
"version_value": "Versions Build between 2015/07 and 2017/03"
}
]
}
}
]
},
"vendor_name": "Dahua Technologies"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "risk of sensitive information leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html",
"refsource": "CONFIRM",
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2017-9315",
"datePublished": "2017-11-28T19:00:00.000Z",
"dateReserved": "2017-05-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:31:08.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39950 (GCVE-0-2024-39950)
Vulnerability from cvelistv5 – Published: 2024-07-31 03:45 – Updated: 2025-09-30 03:39
VLAI
EPSS
VEX
Summary
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-31 15:04 UTC
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dahua | NVR4XXX and IPC-HX8XXX |
Affected:
NVR4XXX and IPC-HX8XXX Versions which Build time before 2024/1/22
|
|
| dahuasecurity | nvr4832-i |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hf8xxx_firmware |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hfw8xxx |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:* |
Date Public
2024-07-31 03:42
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nvr4832-i",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hf8xxx_firmware",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hfw8xxx",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T15:04:00.945009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T19:12:46.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NVR4XXX and IPC-HX8XXX",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "NVR4XXX and IPC-HX8XXX Versions which Build time\u00a0before 2024/1/22"
}
]
}
],
"datePublic": "2024-07-31T03:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization."
}
],
"value": "A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T03:39:46.118Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"url": "https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2024-39950",
"datePublished": "2024-07-31T03:45:12.977Z",
"dateReserved": "2024-07-05T03:08:11.185Z",
"dateUpdated": "2025-09-30T03:39:46.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39944 (GCVE-0-2024-39944)
Vulnerability from cvelistv5 – Published: 2024-07-31 03:13 – Updated: 2025-09-30 03:33
VLAI
EPSS
VEX
Summary
A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-31 15:24 UTC
CWE
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dahua | IPC-HX8XXX and NVR4XXX |
Affected:
IPC-HX8XXX and NVR4XXX Versions which Build time before 2024/2/2
|
|
| dahuasecurity | nvr4832-i |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4416-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4816-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-4ks2\/i:-:*:*:*:*:*:*:* cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hf8xxx_firmware |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:* |
|
| dahuasecurity | ipc-hfw8xxx |
Affected:
0 , < 2024.2.2
(custom)
cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:* |
Date Public
2024-07-31 03:09
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:dahuasecurity:nvr4216-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4416-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4432-i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4816-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-16p-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-4ks2\\/i:-:*:*:*:*:*:*:*",
"cpe:2.3:h:dahuasecurity:nvr4832-i:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "nvr4832-i",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:dahuasecurity:ipc-hf8xxx_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hf8xxx_firmware",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:dahuasecurity:ipc-hfw8xxx:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipc-hfw8xxx",
"vendor": "dahuasecurity",
"versions": [
{
"lessThan": "2024.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T15:24:11.982486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T19:10:56.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPC-HX8XXX and NVR4XXX",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "IPC-HX8XXX and NVR4XXX Versions which Build time before 2024/2/2"
}
]
}
],
"datePublic": "2024-07-31T03:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: var(--wht);\"\u003eA vulnerability has been found in Dahua products.Attackers\ncan send carefully crafted data packets to the interface with vulnerabilities,\ncausing the device to crash.\u003c/span\u003e\u003cbr\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "A vulnerability has been found in Dahua products.Attackers\ncan send carefully crafted data packets to the interface with vulnerabilities,\ncausing the device to crash."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T03:33:00.394Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"url": "https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2024-39944",
"datePublished": "2024-07-31T03:13:03.509Z",
"dateReserved": "2024-07-05T03:08:11.184Z",
"dateUpdated": "2025-09-30T03:33:00.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-9315 (GCVE-0-2017-9315)
Vulnerability from cvelistv5 – Published: 2017-11-28 19:00 – Updated: 2024-09-17 02:31
VLAI
EPSS
VEX
Summary
Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker.
Severity
No CVSS data available.
CWE
- risk of sensitive information leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| http://www.dahuasecurity.com/annoucementsingle/se… | x_refsource_CONFIRM |
Impacted products
1 product
Date Public
2017-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:02:44.242Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Dahua IP Camera and IP PTZ IPC-HFW1XXX, IPC-HDW1XXX, IPC-HDBW1XXX, IPC-HFW2XXX, IPC-HDW2XXX, IPC-HDBW2XXX, IPC-HFW4XXX, IPC-HDW4XXX, IPC-HDBW4XXX, IPC-HF5XXX, IPC-HFW5XXX, IPC-HDW5XXX, IPC-HDBW5XXX, IPC-HF8XXX, IPC-HFW8XXX, IPC-HDBW8XXX, IPC-EBW8XXX, IPC-PFW8xxx, IPC-PDBW8xxx, IPC-HUM8xxx, PSD8xxxx, DH-SD2XXXXX, DH-SD4XXXXX, DH-SD5XXXXX, DH-SD6XXXXX",
"vendor": "Dahua Technologies",
"versions": [
{
"status": "affected",
"version": "Versions Build between 2015/07 and 2017/03"
}
]
}
],
"datePublic": "2017-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "risk of sensitive information leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-28T18:57:01.000Z",
"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"shortName": "dahua"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@dahuatech.com",
"DATE_PUBLIC": "2017-11-10T00:00:00",
"ID": "CVE-2017-9315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Dahua IP Camera and IP PTZ IPC-HFW1XXX, IPC-HDW1XXX, IPC-HDBW1XXX, IPC-HFW2XXX, IPC-HDW2XXX, IPC-HDBW2XXX, IPC-HFW4XXX, IPC-HDW4XXX, IPC-HDBW4XXX, IPC-HF5XXX, IPC-HFW5XXX, IPC-HDW5XXX, IPC-HDBW5XXX, IPC-HF8XXX, IPC-HFW8XXX, IPC-HDBW8XXX, IPC-EBW8XXX, IPC-PFW8xxx, IPC-PDBW8xxx, IPC-HUM8xxx, PSD8xxxx, DH-SD2XXXXX, DH-SD4XXXXX, DH-SD5XXXXX, DH-SD6XXXXX",
"version": {
"version_data": [
{
"version_value": "Versions Build between 2015/07 and 2017/03"
}
]
}
}
]
},
"vendor_name": "Dahua Technologies"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "risk of sensitive information leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html",
"refsource": "CONFIRM",
"url": "http://www.dahuasecurity.com/annoucementsingle/security-advisory--admin-password-recovery-mechanism-in-some-dahua-ip-camera-and-ip-ptz-could-lead-to-security-risk_14731_221.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
"assignerShortName": "dahua",
"cveId": "CVE-2017-9315",
"datePublished": "2017-11-28T19:00:00.000Z",
"dateReserved": "2017-05-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:31:08.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}