What is the CVSS score of CVE-2013-3615?

CVE-2013-3615 has a CVSS 2.0 base score of 7.8 (High). CVSS vector: AV:N/AC:L/Au:N/C:C/I:N/A:N. EPSS exploitation probability: 8.6%.

Is there a public PoC exploit available for CVE-2013-3615?

Yes, a public proof-of-concept exploit is available for CVE-2013-3615. Prioritise patching immediately. EPSS: 8.6%.

Dvr0404Hd A CVE-2013-3615

HIGH

Credentials Management Errors (CWE-255)

2013-09-17 cret@cert.org

Dahua Authentication Bypass Dvr0404Hd A Dvr0404Hd L Dvr0404Hd S Dvr0404Hd U Dvr0404Hf A E Dvr0404Hf Al E Dvr0404Hf S E Dvr0404Hf U E Dvr0804 Dvr0804Hd L Dvr0804Hd S Dvr0804Hf A E Dvr0804Hf Al E Dvr0804Hf L E Dvr0804Hf S E Dvr0804Hf U E Dvr1604Hd L Dvr1604Hd S Dvr1604Hf A E Dvr1604Hf Al E Dvr1604Hf L E Dvr1604Hf S E Dvr1604Hf U E Dvr2104C Dvr2104H Dvr2104Hc Dvr2104He Dvr2108C Dvr2108H Dvr2108Hc Dvr2108He Dvr2116C Dvr2116H Dvr2116Hc Dvr2116He Dvr2404Hf S Dvr2404Lf Al Dvr2404Lf S Dvr3204Hf S Dvr3204Lf Al Dvr3204Lf S Dvr3224L Dvr3232L Dvr5104C Dvr5104H Dvr5104He Dvr5108C Dvr5108H Dvr5108He Dvr5116C Dvr5116H Dvr5116He Dvr5204A Dvr5204L Dvr5208A Dvr5208L Dvr5216A Dvr5216L Dvr5404 Dvr5408 Dvr5416 Dvr5804 Dvr5808 Dvr5816 Dvr6404Lf S

7.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:N/AC:L/Au:N/C:C/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 17, 2013 - 12:04 cve.org

HIGH 7.8

DescriptionCVE.org

Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack.

AnalysisAI

Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-255. Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack. Affected products include: Dahuasecurity Dvr0404Hd-A, Dahuasecurity Dvr0404Hd-L, Dahuasecurity Dvr0404Hd-S, Dahuasecurity Dvr0404Hd-U, Dahuasecurity Dvr0404Hf-A-E.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.