Hard-coded credentials in Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras
Priority MEDIUM 58CWE-836Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obtaining the actual password.
Why it matters now
EPSS 0.36747 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras | Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras | — | No fix listed | CNA |
- Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Vendor— Affected Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hdbw23a0rn-zs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hdbw13a0sn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hdw1xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hdw2xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hdw4xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
- cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hdbw23a0rn-zs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hdbw13a0sn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hdw1xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hdw2xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hdw4xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hfw1xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hfw2xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-ipc-hfw4xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-sd6cxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-sd6cxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-nvr1xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-nvr1xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-hcvr4xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:ddh-hcvr4xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dh-hcvr5xxx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dh-hcvr5xxx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dhi-hcvr51a04he-s3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dhi-hcvr51a04he-s3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dhi-hcvr51a08he-s3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dhi-hcvr51a08he-s3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
| cpe:2.3:o:dahuasecurity:dhi-hcvr58a32s-s2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Dahua Technologies |
| cpe:2.3:h:dahuasecurity:dhi-hcvr58a32s-s2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dahua Technologies |
- cpe:2.3:o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hfw1xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hfw2xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-ipc-hfw4xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-sd6cxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-sd6cxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-nvr1xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-nvr1xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-hcvr4xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:ddh-hcvr4xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dh-hcvr5xxx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dh-hcvr5xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dhi-hcvr51a04he-s3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dhi-hcvr51a04he-s3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dhi-hcvr51a08he-s3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dhi-hcvr51a08he-s3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
- cpe:2.3:o:dahuasecurity:dhi-hcvr58a32s-s2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
- cpe:2.3:h:dahuasecurity:dhi-hcvr58a32s-s2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7927
- 2026-10-03 Alias added: GHSA-c2vq-prj2-mrqc
References
More Dahua Technologies Dh-hcvr4xxx Firmware vulnerabilities
- TI-2017-05534 Insufficiently protected credentials in Dahua Technology Co., Ltd Digital Video Recorders… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2017-7927 · CVE Program
- CVE-2017-7927 · NVD
- FIRST EPSS
- GHSA-c2vq-prj2-mrqc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences