CVE-2020-9501
Medium
Description
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
SeverityMedium
CVSS5.5
Exploit probability—
ProductDahuasecurity Web
PublishedMay 13, 2020
First seenMay 13, 2020
How to fix
Update
- dahuasecurity web_p2p2020-04 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dahuasecurity web_p2p | v < 2020-04 | 2020-04 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.