CVE-2019-3948
Description
The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
How to fix
- dahua dh-ipc-hx863x2018-05-18 or later
- dahua dh-ipc-hx883x2018-05-18 or later
- dahua dh-sd4xxxxx2018-05-18 or later
- dahua dh-sd5xxxxx2018-05-18 or later
- dahua dh-sd6xxxxx2018-05-18 or later
- dahua ipc-hx4x3x2018-05-18 or later
- dahua ipc-hx5x3x2018-05-18 or later
- dahua ipc-xxbxx2018-05-18 or later
- dahua nvr2xxx-4ks22018-05-18 or later
- dahua nvr4xxx-4ks22018-05-18 or later
- dahua nvr5xxx-4ks22018-05-18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amcrest ip2m-841b_firmware | 2.520.ac00.18.r | — |
| dahua dh-ipc-hx863x | v < 2018-05-18 | 2018-05-18 |
| dahua dh-ipc-hx883x | v < 2018-05-18 | 2018-05-18 |
| dahua dh-sd4xxxxx | v < 2018-05-18 | 2018-05-18 |
| dahua dh-sd5xxxxx | v < 2018-05-18 | 2018-05-18 |
| dahua dh-sd6xxxxx | v < 2018-05-18 | 2018-05-18 |
| dahua ipc-hx4x3x | v < 2018-05-18 | 2018-05-18 |
| dahua ipc-hx5x3x | v < 2018-05-18 | 2018-05-18 |
| dahua ipc-xxbxx | v < 2018-05-18 | 2018-05-18 |
| dahua nvr2xxx-4ks2 | v < 2018-05-18 | 2018-05-18 |
| dahua nvr4xxx-4ks2 | v < 2018-05-18 | 2018-05-18 |
| dahua nvr5xxx-4ks2 | v < 2018-05-18 | 2018-05-18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.