What is the CVSS score of CVE-2013-5754?

CVE-2013-5754 has a CVSS 2.0 base score of 10.0 (Critical). CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 1.6%.

Dvr0404Hd A CVE-2013-5754

CRITICAL

Permissions, Privileges, and Access Controls (CWE-264)

2013-09-17 cve@mitre.org

Privilege Escalation Dahua Dvr0404Hd A Dvr0404Hd L Dvr0404Hd S Dvr0404Hd U Dvr0404Hf A E Dvr0404Hf Al E Dvr0404Hf S E Dvr0404Hf U E Dvr0804 Dvr0804Hd L Dvr0804Hd S Dvr0804Hf A E Dvr0804Hf Al E Dvr0804Hf L E Dvr0804Hf S E Dvr0804Hf U E Dvr1604Hd L Dvr1604Hd S Dvr1604Hf A E Dvr1604Hf Al E Dvr1604Hf L E Dvr1604Hf S E Dvr1604Hf U E Dvr2104C Dvr2104H Dvr2104Hc Dvr2104He Dvr2108C Dvr2108H Dvr2108Hc Dvr2108He Dvr2116C Dvr2116H Dvr2116Hc Dvr2116He Dvr2404Hf S Dvr2404Lf Al Dvr2404Lf S Dvr3204Hf S Dvr3204Lf Al Dvr3204Lf S Dvr3224L Dvr3232L Dvr5104C Dvr5104H Dvr5104He Dvr5108C Dvr5108H Dvr5108He Dvr5116C Dvr5116H Dvr5116He Dvr5204A Dvr5204L Dvr5208A Dvr5208L Dvr5216A Dvr5216L Dvr5404 Dvr5408 Dvr5416 Dvr5804 Dvr5808 Dvr5816 Dvr6404Lf S

10.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 17, 2013 - 12:04 cve.org

CRITICAL 10.0

DescriptionCVE.org

The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.

AnalysisAI

The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612. Affected products include: Dahuasecurity Dvr0404Hd-A, Dahuasecurity Dvr0404Hd-L, Dahuasecurity Dvr0404Hd-S, Dahuasecurity Dvr0404Hd-U, Dahuasecurity Dvr0404Hf-A-E.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.