What is the CVSS score of CVE-2013-3614?

CVE-2013-3614 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 10.8%.

Is there a public PoC exploit available for CVE-2013-3614?

Yes, a public proof-of-concept exploit is available for CVE-2013-3614. Prioritise patching immediately. EPSS: 10.8%.

Dvr0404Hd A CVE-2013-3614

CRITICAL

Permissions, Privileges, and Access Controls (CWE-264)

2013-09-17 cret@cert.org

Privilege Escalation Dahua Dvr0404Hd A Dvr0404Hd L Dvr0404Hd S Dvr0404Hd U Dvr0404Hf A E Dvr0404Hf Al E Dvr0404Hf S E Dvr0404Hf U E Dvr0804 Dvr0804Hd L Dvr0804Hd S Dvr0804Hf A E Dvr0804Hf Al E Dvr0804Hf L E Dvr0804Hf S E Dvr0804Hf U E Dvr1604Hd L Dvr1604Hd S Dvr1604Hf A E Dvr1604Hf Al E Dvr1604Hf L E Dvr1604Hf S E Dvr1604Hf U E Dvr2104C Dvr2104H Dvr2104Hc Dvr2104He Dvr2108C Dvr2108H Dvr2108Hc Dvr2108He Dvr2116C Dvr2116H Dvr2116Hc Dvr2116He Dvr2404Hf S Dvr2404Lf Al Dvr2404Lf S Dvr3204Hf S Dvr3204Lf Al Dvr3204Lf S Dvr3224L Dvr3232L Dvr5104C Dvr5104H Dvr5104He Dvr5108C Dvr5108H Dvr5108He Dvr5116C Dvr5116H Dvr5116He Dvr5204A Dvr5204L Dvr5208A Dvr5208L Dvr5216A Dvr5216L Dvr5404 Dvr5408 Dvr5416 Dvr5804 Dvr5808 Dvr5816 Dvr6404Lf S

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 17, 2013 - 12:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack.

AnalysisAI

Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 10.8%.

Technical ContextAI

This vulnerability is classified under CWE-264. Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack. Affected products include: Dahuasecurity Dvr0404Hd-A, Dahuasecurity Dvr0404Hd-L, Dahuasecurity Dvr0404Hd-S, Dahuasecurity Dvr0404Hd-U, Dahuasecurity Dvr0404Hf-A-E.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.