CVE-2017-6432: High severity Dahuasecurity Nvr Firmware vulnerability
An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6432?
CVE-2017-6432 has a high severity due to the potential for Man-in-the-Middle attacks and exploitation of unencrypted communications.
How do I fix CVE-2017-6432?
To mitigate CVE-2017-6432, update to the latest firmware version provided by Dahua that addresses security vulnerabilities.
What devices are affected by CVE-2017-6432?
CVE-2017-6432 affects Dahua DHI-HCVR7216A-S3 devices running firmware version 3.210.0001.10.
What attack vectors are associated with CVE-2017-6432?
CVE-2017-6432 allows for packet sniffing and injection through Man-in-the-Middle attacks due to unencrypted communication on TCP Port 37777.
Is CVE-2017-6432 an authentication-related vulnerability?
CVE-2017-6432 does not specifically relate to authentication but allows attackers to manipulate device communications.