CVE-2020-9499: Buffer Overflow
Published Apr 9, 2020
·Updated
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
Affected Software
76 affected components
Dahuasecurity Sd6al Firmware<2019-12
Dahuasecurity Sd6al
Dahuasecurity Sd5a Firmware<2019-12
Dahuasecurity Sd5a
Dahuasecurity Sd1a Firmware<2019-12
Dahuasecurity Sd1a
Dahuasecurity Ptz1a Firmware<2019-12
Dahuasecurity Ptz1a
Dahuasecurity Sd50 Firmware<2019-12
Dahuasecurity Sd50
Dahuasecurity Sd52c Firmware<2019-12
Dahuasecurity Sd52c
Dahuasecurity Ipc-hx5842h Firmware<2019-12
Dahuasecurity Ipc-hx5842h
Dahuasecurity Ipc-hx7842h Firmware<2019-12
Dahuasecurity Ipc-hx7842h
Dahuasecurity Ipc-hx2xxx Firmware<2019-12
Dahuasecurity Ipc-hx2xxx
Dahuasecurity Ipc-hxxx5x4x Firmware<2019-12
Dahuasecurity Ipc-hxxx5x4x
Dahuasecurity N42b1p Firmware<2019-12
Dahuasecurity N42b1p
Dahuasecurity N42b2p Firmware<2019-12
Dahuasecurity N42b2p
Dahuasecurity N42b3p Firmware<2019-12
Dahuasecurity N42b3p
Dahuasecurity N52a4p Firmware<2019-12
Dahuasecurity N52a4p
Dahuasecurity N54a4p Firmware<2019-12
Dahua N54a4p
Dahuasecurity N52b2p Firmware<2019-12
Dahuasecurity N52b2p
Dahuasecurity N52b5p Firmware<2019-12
Dahuasecurity N52b5p
Dahuasecurity N52b3p Firmware<2019-12
Dahuasecurity N52b3p
Dahuasecurity N54b2p Firmware<2019-12
Dahuasecurity N54b2p
All of the following
Dahuasecurity Sd6al Firmware<2019-12
Dahuasecurity Sd6al
All of the following
Dahuasecurity Sd5a Firmware<2019-12
Dahuasecurity Sd5a
All of the following
Dahuasecurity Sd1a Firmware<2019-12
Dahuasecurity Sd1a
All of the following
Dahuasecurity Ptz1a Firmware<2019-12
Dahuasecurity Ptz1a
All of the following
Dahuasecurity Sd50 Firmware<2019-12
Dahuasecurity Sd50
All of the following
Dahuasecurity Sd52c Firmware<2019-12
Dahuasecurity Sd52c
All of the following
Dahuasecurity Ipc-hx5842h Firmware<2019-12
Dahuasecurity Ipc-hx5842h
All of the following
Dahuasecurity Ipc-hx7842h Firmware<2019-12
Dahuasecurity Ipc-hx7842h
All of the following
Dahuasecurity Ipc-hx2xxx Firmware<2019-12
Dahuasecurity Ipc-hx2xxx
All of the following
Dahuasecurity Ipc-hxxx5x4x Firmware<2019-12
Dahuasecurity Ipc-hxxx5x4x
All of the following
Dahuasecurity N42b1p Firmware<2019-12
Dahuasecurity N42b1p
All of the following
Dahuasecurity N42b2p Firmware<2019-12
Dahuasecurity N42b2p
All of the following
Dahuasecurity N42b3p Firmware<2019-12
Dahuasecurity N42b3p
All of the following
Dahuasecurity N52a4p Firmware<2019-12
Dahuasecurity N52a4p
All of the following
Dahuasecurity N54a4p Firmware<2019-12
Dahua N54a4p
All of the following
Dahuasecurity N52b2p Firmware<2019-12
Dahuasecurity N52b2p
All of the following
Dahuasecurity N52b5p Firmware<2019-12
Dahuasecurity N52b5p
All of the following
Dahuasecurity N52b3p Firmware<2019-12
Dahuasecurity N52b3p
All of the following
Dahuasecurity N54b2p Firmware<2019-12
Dahuasecurity N54b2p
Event History
Apr 9, 2020
CVE Published
via MITRE·01:19 PM
Data Sourced
via MITRE·01:19 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-9499.
2
What is the severity of CVE-2020-9499?
The severity of CVE-2020-9499 is high with a CVSS score of 7.2.
3
Which Dahua products are affected by CVE-2020-9499?
Some Dahua products, including Dahuasecurity Sd6al Firmware and Dahuasecurity Sd5a Firmware, are affected by CVE-2020-9499.
4
How can the attacker exploit CVE-2020-9499?
The attacker can exploit CVE-2020-9499 by sending a specific DDNS test command after successfully logging in to the device.
5
What is the fix for CVE-2020-9499?
To fix CVE-2020-9499, it is recommended to update the affected Dahua products to a version released after December 2019.