CVE-2017-7927

High

Published: 06/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability was found in Dahua devices involving the use of password hash instead of password for authentication. This could allow a malicious user to bypass authentication without needing the actual password.

Risk Assessment

The organization may be exposed to unauthorized access to systems, potentially leading to data loss or security breaches.

Recommendation

It is recommended to update the device firmware and implement stronger authentication mechanisms to minimize risk.

Other vulnerabilities in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, DHI-HCVR58A32S-S2

CVE-2017-7925Critical
A Password in Configuration File issue was identified in Dahua devices such as DH-IPC-HDBW23A0RN-ZS and others. This vulnerability could allow a malicious user to assume the identity of a privileged user and gain access to sensitive information.

Original NVD description (English source)

A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obtaining the actual password.