CVE-2022-45429: SSRF
Published Dec 27, 2022
·Updated
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
Affected Software
40 affected components
Dahuasecurity Dss Express=7.002.1760000.2
Dahuasecurity Dss Express=8.0.2
Dahuasecurity Dss Express=8.0.4
Dahuasecurity Dss Express=8.1
Dahuasecurity Dss Express=8.1.1
Dahuasecurity Dss Professional=7.002.1760000.2
Dahuasecurity Dss Professional=8.0.2
Dahuasecurity Dss Professional=8.0.4
Dahuasecurity Dss Professional=8.1
Dahuasecurity Dss Professional=8.1.1
Dahuasecurity Dhi-dss7016d-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.1
Dahuasecurity Dhi-dss7016d-s2
Dahuasecurity Dhi-dss7016dr-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.1
Dahuasecurity Dhi-dss7016dr-s2
Dahuasecurity Dhi-dss4004-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss4004-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss4004-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss4004-s2 Firmware=8.1
Dahuasecurity Dhi-dss4004-s2
All of the following
Any of the following
Dahuasecurity Dhi-dss7016d-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss7016d-s2 Firmware=8.1
Dahuasecurity Dhi-dss7016d-s2
All of the following
Any of the following
Dahuasecurity Dhi-dss7016dr-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss7016dr-s2 Firmware=8.1
Dahuasecurity Dhi-dss7016dr-s2
All of the following
Any of the following
Dahuasecurity Dhi-dss4004-s2 Firmware=1.001.0000001.2
Dahuasecurity Dhi-dss4004-s2 Firmware=8.0.2
Dahuasecurity Dhi-dss4004-s2 Firmware=8.0.4
Dahuasecurity Dhi-dss4004-s2 Firmware=8.1
Dahuasecurity Dhi-dss4004-s2
Remediation
Event History
Dec 27, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this Dahua software vulnerability?
The vulnerability ID of this Dahua software vulnerability is CVE-2022-45429.
2
What is the severity of CVE-2022-45429?
The severity of CVE-2022-45429 is high, with a severity value of 7.5.
3
Which Dahua software products are affected by CVE-2022-45429?
Dahuasecurity Dss Express versions 7.002.1760000.2, 8.0.2, 8.0.4, 8.1, and 8.1.1, as well as Dahuasecurity Dss Professional versions 7.002.1760000.2, 8.0.2, 8.0.4, and 8.1.1 are affected by CVE-2022-45429.
4
What is the vulnerability type of CVE-2022-45429?
The vulnerability type of CVE-2022-45429 is server-side request forgery (SSRF).
5
How can an attacker exploit CVE-2022-45429?
An attacker can exploit CVE-2022-45429 by accessing internal resources through concatenating specific URL links.