Read the docs
TI-2017-04168 Aliases CVE-2017-6342GHSA-f8hh-555p-7c36

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10…

Priority MEDIUM 56CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117.

Why it matters now

EPSS 0.12757 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:*:*:*:*:*:*:*2.400.0000.28.rVulnerableDahua Technologies
cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:*:*:*:*:*:*:*3.210.0001.10VulnerableDahua Technologies
cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:*:*:*:*:*:*:*1.16.1VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
  • cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:*:*:*:*:*:*:* Versions 2.400.0000.28.r Vulnerable ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:*:*:*:*:*:*:* Versions 3.210.0001.10 Vulnerable ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:*:*:*:*:*:*:* Versions 1.16.1 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:dhi-hcvr7216a-s3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6342
  2. 2026-10-03 Alias added: GHSA-f8hh-555p-7c36

References

Advisory 1

  • TI-2017-04169 The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10… CVSS 3.0HIGH 8.1
  • TI-2017-04167 Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera… CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences