CVE-2022-45432

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-45432
Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated search for devices in range of IPs from remote DSS Server.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.dahuasecurity.com/support/cybersecurity/details/1137 Patch Vendor Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/1137 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss7016d-s2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss7016dr-s2:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.2:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.4:*:*:*:*:*:*:*
cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.1:*:*:*:*:*:*:*
cpe:2.3:h:dahuasecurity:dhi-dss4004-s2:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:a:dahuasecurity:dss_express:7.002.1760000.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_express:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:7.002.1760000.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.1:*:*:*:*:*:*:*
cpe:2.3:a:dahuasecurity:dss_professional:8.1.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

14 Apr 2025, 14:15

Type Values Removed Values Added
CWE CWE-306

21 Nov 2024, 07:29

Type Values Removed Values Added
Summary
  • (es) Algunos productos de software de Dahua tienen la vulnerabilidad de búsqueda de dispositivos no autenticados. Después de omitir la política de control de acceso del firewall, al enviar un paquete manipulado específicamente a la interfaz vulnerable, un atacante podría buscar dispositivos no autenticados en un rango de IP desde el servidor DSS remoto.
References () https://www.dahuasecurity.com/support/cybersecurity/details/1137 - Patch, Vendor Advisory () https://www.dahuasecurity.com/support/cybersecurity/details/1137 - Patch, Vendor Advisory
Information

Published : 2022-12-27 18:15

Updated : 2025-04-14 14:15

NVD link : CVE-2022-45432

Mitre link : CVE-2022-45432

CVE.ORG link : CVE-2022-45432

JSON object : View

Products Affected

dahuasecurity

  • dhi-dss7016dr-s2_firmware
  • dhi-dss7016dr-s2
  • dhi-dss7016d-s2_firmware
  • dhi-dss7016d-s2
  • dhi-dss4004-s2
  • dss_professional
  • dhi-dss4004-s2_firmware
  • dss_express

microsoft

  • windows
CWE
NVD-CWE-noinfo CWE-306

Missing Authentication for Critical Function