CVE-2017-6432

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.

• CWE-319

• https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.htmlThird Party Advisory
• https://twitter.com/null_ku7/status/839814344351240193Press/Media Coverage
• https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.htmlThird Party Advisory
• https://twitter.com/null_ku7/status/839814344351240193Press/Media Coverage

Published

Mar 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6424An elevation of privilege vulnerability in the Qualcomm WiFi…
• CVE-2017-6425An information disclosure vulnerability in the Qualcomm vide…
• CVE-2017-6426An information disclosure vulnerability in the Qualcomm SPMI…
• CVE-2017-6427A Buffer Overflow was discovered in EvoStream Media Server 1…
• CVE-2017-6429Buffer overflow in the tcpcapinfo utility in Tcpreplay befor…7.8
• CVE-2017-6430The compile_tree function in ef_compiler.c in the Etterfilte…
• CVE-2017-6435The parse_string_node function in bplist.c in libimobiledevi…
• CVE-2017-6436The parse_string_node function in bplist.c in libimobiledevi…
• CVE-2017-6437The base64encode function in base64.c in libimobiledevice li…
• CVE-2017-6438Heap-based buffer overflow in the parse_unicode_node functio…
• CVE-2017-6439Heap-based buffer overflow in the parse_string_node function…
• CVE-2017-6440The parse_data_node function in bplist.c in libimobiledevice…