What is the CVSS score of CVE-2013-3613?

CVE-2013-3613 has a CVSS 2.0 base score of 7.8 (High). CVSS vector: AV:N/AC:L/Au:N/C:C/I:N/A:N. EPSS exploitation probability: 12.0%.

Is there a public PoC exploit available for CVE-2013-3613?

Yes, a public proof-of-concept exploit is available for CVE-2013-3613. Prioritise patching immediately. EPSS: 12.0%.

Dvr0404Hd A CVE-2013-3613

HIGH

Improper Authentication (CWE-287)

2013-09-17 cret@cert.org

Dahua Authentication Bypass Dvr0404Hd A Dvr0404Hd L Dvr0404Hd S Dvr0404Hd U Dvr0404Hf A E Dvr0404Hf Al E Dvr0404Hf S E Dvr0404Hf U E Dvr0804 Dvr0804Hd L Dvr0804Hd S Dvr0804Hf A E Dvr0804Hf Al E Dvr0804Hf L E Dvr0804Hf S E Dvr0804Hf U E Dvr1604Hd L Dvr1604Hd S Dvr1604Hf A E Dvr1604Hf Al E Dvr1604Hf L E Dvr1604Hf S E Dvr1604Hf U E Dvr2104C Dvr2104H Dvr2104Hc Dvr2104He Dvr2108C Dvr2108H Dvr2108Hc Dvr2108He Dvr2116C Dvr2116H Dvr2116Hc Dvr2116He Dvr2404Hf S Dvr2404Lf Al Dvr2404Lf S Dvr3204Hf S Dvr3204Lf Al Dvr3204Lf S Dvr3224L Dvr3232L Dvr5104C Dvr5104H Dvr5104He Dvr5108C Dvr5108H Dvr5108He Dvr5116C Dvr5116H Dvr5116He Dvr5204A Dvr5204L Dvr5208A Dvr5208L Dvr5216A Dvr5216L Dvr5404 Dvr5408 Dvr5416 Dvr5804 Dvr5808 Dvr5816 Dvr6404Lf S

7.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:N/AC:L/Au:N/C:C/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 17, 2013 - 12:04 cve.org

HIGH 7.8

DescriptionCVE.org

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.

AnalysisAI

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.0%.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port. Affected products include: Dahuasecurity Dvr0404Hd-A, Dahuasecurity Dvr0404Hd-L, Dahuasecurity Dvr0404Hd-S, Dahuasecurity Dvr0404Hd-U, Dahuasecurity Dvr0404Hf-A-E.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.