CVE-2013-3612

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-09-17 · updated 2026-06-16
Weakness: CWE-255

Description

Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.

Affected products

Dahuasecurity Dvr0404Hd-A: all versions
Dahuasecurity Dvr0404Hd-L: all versions
Dahuasecurity Dvr0404Hd-S: all versions
Dahuasecurity Dvr0404Hd-U: all versions
Dahuasecurity Dvr0404Hf-A-E: all versions
Dahuasecurity Dvr0404Hf-Al-E: all versions
Dahuasecurity Dvr0404Hf-S-E: all versions
Dahuasecurity Dvr0404Hf-U-E: all versions
Dahuasecurity Dvr0804: all versions
Dahuasecurity Dvr0804Hd-L: all versions
Dahuasecurity Dvr0804Hd-S: all versions
Dahuasecurity Dvr0804Hf-A-E: all versions
Dahuasecurity Dvr0804Hf-Al-E: all versions
Dahuasecurity Dvr0804Hf-L-E: all versions
Dahuasecurity Dvr0804Hf-S-E: all versions
Dahuasecurity Dvr0804Hf-U-E: all versions
Dahuasecurity Dvr1604Hd-L: all versions
Dahuasecurity Dvr1604Hd-S: all versions
Dahuasecurity Dvr1604Hf-A-E: all versions
Dahuasecurity Dvr1604Hf-Al-E: all versions
Dahuasecurity Dvr1604Hf-L-E: all versions
Dahuasecurity Dvr1604Hf-S-E: all versions
Dahuasecurity Dvr1604Hf-U-E: all versions
Dahuasecurity Dvr2104C: all versions
Dahuasecurity Dvr2104H: all versions
Dahuasecurity Dvr2104Hc: all versions
Dahuasecurity Dvr2104He: all versions
Dahuasecurity Dvr2108C: all versions
Dahuasecurity Dvr2108H: all versions
Dahuasecurity Dvr2108Hc: all versions

References

Get alerted when CVE-2013-3612 or the next vulnerability affects your stack