A vulnerability was found in Dahua IPC-HFW1XXX, IPC-HDW1XXX and IPC-HFW2XXX. It has been classified as critical. This affects an unknown function of the component Redirect Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability.

The weakness was disclosed 06/12/2019. This vulnerability is uniquely identified as CVE-2019-9676 since 03/11/2019. An attack has to be approached locally. The successful exploitation requires a authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 2018-11 eliminates this vulnerability.

The entries VDB-159650, VDB-160557, VDB-162237 and VDB-164476 are pretty similar.

Productinfo

Vendor

• Dahua

Name

• IPC-HDW1XXX
• IPC-HFW1XXX
• IPC-HFW2XXX

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion