Read the docs
TI-2017-02426 Aliases CVE-2017-3223GHSA-4vg2-f4g9-pc4r

Stack-based buffer overflow in Dahua IP Camera

Priority MEDIUM 50CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow. Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely. Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the 'password' field of the web interface. A remote, unauthenticated attacker may submit a crafted POST request to the IP camera's Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution. The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.

Why it matters now

EPSS 0.05219 92nd percentileScored 2026-11-07
Fix Fixed IP Camera (Dahua): DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DahuaIP CameraDH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 to before DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621Patch availableCNA
  • IP Camera VendorDahua Affected DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 to before DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 Fixed in DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:ip_camera_firmware:*:*:*:*:*:*:*:*before dh_ipc-ack-themis_eng_p_v2.400.0000.14.r.20170713.binVulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ip_camera:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ip_camera_firmware:*:*:*:*:*:*:*:*before 2.400.0000.14.r.20170713VulnerableDahua Technologies
  • cpe:2.3:o:dahuasecurity:ip_camera_firmware:*:*:*:*:*:*:*:* Versions before dh_ipc-ack-themis_eng_p_v2.400.0000.14.r.20170713.bin Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ip_camera:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ip_camera_firmware:*:*:*:*:*:*:*:* Versions before 2.400.0000.14.r.20170713 Vulnerable ·Dahua Technologies

Remediation

  • Fix · CNA IP Camera (Dahua) Fixed in DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3223
  2. 2026-10-03 Alias added: GHSA-4vg2-f4g9-pc4r

References

Advisory 1

  • TI-2021-12646 Improper authentication in Some Dahua IP Camera, Video Intercom, NVR, XVR devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-12645 Improper authentication in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-03585 Dahua Smart Park Management unrestricted upload CVSS 3.1CRITICAL 9.8
  • TI-2024-12178 Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal CVSS 4.0MEDIUM 5.3
  • TI-2019-02954 Missing authentication in Dahua IPC-XXBXX CVSS 3.0HIGH 7.5
  • TI-2025-43987 Command injection in Dahua Intelligent Connection Center CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences