A vulnerability classified as problematic was found in Dahua DSS Professional, DSS Express, DHI-DSS7016D-S2, DHI-DSS7016DR-S2 and DHI-DSS4004-S2. This vulnerability affects an unknown code of the component Packet Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can obtain the debugging information.

The weakness was disclosed 12/27/2022. The advisory is shared for download at dahuasecurity.com. This vulnerability was named CVE-2022-45428 since 11/14/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Applying a patch is able to eliminate this problem.

The entries VDB-216885, VDB-216886, VDB-216887 and VDB-216888 are pretty similar.

Productinfo

Vendor

• Dahua

Name

• DHI-DSS4004-S2
• DHI-DSS7016D-S2
• DHI-DSS7016DR-S2
• DSS Express
• DSS Professional

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion