A vulnerability, which was classified as critical, was found in Dahua IPC-HDBW2XXX, IPC-HFW2XXX and ASI7XXXX (affected version unknown). This affects an unknown functionality of the component Header Handler. The manipulation of the argument Host with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.

The weakness was disclosed 06/29/2022. The advisory is shared at dahuasecurity.com. This vulnerability is uniquely identified as CVE-2022-30562 since 05/11/2022. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading eliminates this vulnerability.

Productinfo

Vendor

• Dahua

Name

• ASI7XXXX
• IPC-HDBW2XXX
• IPC-HFW2XXX

License

• commercial

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion