What is the CVSS score of CVE-2017-9315?

CVE-2017-9315 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Ipc Hfw1Xxx Firmware CVE-2017-9315

CRITICAL

2017-11-28 cybersecurity@dahuatech.com

Information Disclosure Dahua Ipc Hfw1Xxx Firmware Ipc Hdw1Xxx Firmware Ipc Hdbw1Xxx Firmware Ipc Hfw2Xxx Firmware Ipc Hdw2Xxx Firmware Ipc Hdbw2Xxx Firmware Ipc Hfw4Xxx Firmware Ipc Hdw4Xxx Firmware Ipc Hdbw4Xxx Firmware Ipc Hf5Xxx Firmware Ipc Hfw5Xxx Firmware Ipc Hdw5Xxx Firmware Ipc Hdbw5Xxx Firmware Ipc Hf8Xxx Firmware Ipc Hfw8Xxx Firmware Ipc Hdbw8Xxx Firmware Ipc Ebw8Xxx Firmware Ipc Pfw8Xxx Firmware Dh Sd2Xxxxx Firmware Ipc Pdbw8Xxx Firmware Ipc Hum8Xxx Firmware Psd8Xxxx Firmware Dh Sd4Xxxxx Firmware Dh Sd5Xxxxx Firmware Dh Sd6Xxxxx Firmware

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 28, 2017 - 19:29 cve.org

CRITICAL 9.8

DescriptionCVE.org

AnalysisAI

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by attacker. Affected products include: Dahuasecurity Ipc-Hfw1Xxx Firmware, Dahuasecurity Ipc-Hdw1Xxx Firmware, Dahuasecurity Ipc-Hdbw1Xxx Firmware, Dahuasecurity Ipc-Hfw2Xxx Firmware, Dahuasecurity Ipc-Hdw2Xxx Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.