CVE-2017-6343

High

Published: 27/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The web interface on Dahua DHI-HCVR7216A-S3 devices with specified firmware versions allows remote attackers to gain login access by leveraging knowledge of the MD5 Admin Hash without knowing the corresponding password.

Risk Assessment

Attackers can gain unauthorized access to the system, potentially leading to data theft or device takeover.

Recommendation

It is recommended to update the firmware to the latest version and implement stronger authentication mechanisms.

Other vulnerabilities in Dahua DHI-HCVR7216A-S3, NVR Firmware 3.210.0001.10, Camera Firmware 2.400.0000.28.R, SmartPSS Software 1.16.1

CVE-2017-6342Critical
An issue exists on Dahua DHI-HCVR7216A-S3 devices with specific firmware versions where SmartPSS automatically logs in as admin on the login screen. This allows sniffing sensitive information without prior knowledge of the password.

Original NVD description (English source)

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117.