CVE-2019-9681
Last modified
CVE-2019-9681 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dahuasecurity | Ipc-Hdw1x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hfw1x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hdw2x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hfw2x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hdw4x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hfw4x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hdbw4x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hdw5x2x Firmware | < 2019-08-18 |
| Dahuasecurity | Ipc-Hfw5x2x Firmware | < 2019-08-18 |
References
- https://www.dahuasecurity.com/support/cybersecurity/details/637Patch, Vendor Advisory
- https://www.dahuasecurity.com/support/cybersecurity/details/637Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-9681?
How severe is CVE-2019-9681?
How do I fix CVE-2019-9681?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-9675An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x b…
- CVE-2019-9676Buffer overflow vulnerability found in some Dahua IP Camera …
- CVE-2019-9677The specific fields of CGI interface of some Dahua products …9.8
- CVE-2019-9678Some Dahua products have the problem of denial of service du…7.5
- CVE-2019-9679Some of Dahua's Debug functions do not have permission separ…8.8
- CVE-2019-9680Some Dahua products have information leakage issues. Attacke…5.3
- CVE-2019-9682Dahua devices with Build time before December 2019 use stron…8.1
- CVE-2019-9686pacman before 5.1.3 allows directory traversal when installi…8.8
- CVE-2019-9687PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::…
- CVE-2019-9688sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=…
- CVE-2019-9689process_certificate in tls1.c in Cameron Hamilton-Rich axTLS…7.5
- CVE-2019-9692class.showtime2_image.php in CMS Made Simple (CMSMS) before …
Are you affected by CVE-2019-9681?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST