What is the CVSS score of CVE-2017-9316?

CVE-2017-9316 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 1.7%.

Is there a patch available for CVE-2017-9316?

Yes, a patch is available for CVE-2017-9316. Update the affected software to the latest version immediately.

Nvr11Hs Firmware CVE-2017-9316

MEDIUM

Improper Authentication (CWE-287)

2017-11-27 cybersecurity@dahuatech.com

RCE Authentication Bypass Dahua Nvr11Hs Firmware Ipc Hdw4300S Firmware Ipc Hfw4X00 Firmware Ipc Hdw4X00 Firmware Ipc Hdbw4X00 Firmware Ipc Hf5X00 Firmware Ipc Hfw5X00 Firmware Ipc Hdw5X00 Firmware Ipc Hdbw5X00 Firmware

6.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Nov 27, 2017 - 17:29 cve.org

MEDIUM 6.5

DescriptionCVE.org

Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.

AnalysisAI

Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution. Affected products include: Dahuasecurity Nvr11Hs Firmware, Dahuasecurity Ipc-Hdw4300S Firmware, Dahuasecurity Ipc-Hfw4X00 Firmware, Dahuasecurity Ipc-Hdw4X00 Firmware, Dahuasecurity Ipc-Hdbw4X00 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.