What’s Vulnerable › Vulnerabilities

CVE-2017-9314

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-13 · updated 2026-06-17
• Weakness: CWE-287

Description

Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of forging json message.

Affected products

• Dahuasecurity Nvr5208-4Ks2 Firmware: before dh_nvr5208_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5208_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5208-8P-4Ks2 Firmware: before dh_nvr5208_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5208_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5216-16P-4Ks2 Firmware: before dh_nvr5216_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5216_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5216-4Ks2 Firmware: before dh_nvr5216_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5216_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5216-8P-4Ks2 Firmware: before dh_nvr5216_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5216_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5224-24P-4Ks2 Firmware: before dh_nvr5224_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5224_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5232-16P-4Ks2 Firmware: before dh_nvr5232_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5232_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5232-4Ks2 Firmware: before dh_nvr5232_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5232_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5232-8P-4Ks2 Firmware: before dh_nvr5232_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5232_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5416-16P-4Ks2 Firmware: before dh_nvr5416_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5416_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5416-4Ks2 Firmware: before dh_nvr5416_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5416_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5424-24P-4Ks2 Firmware: before dh_nvr5424_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5424_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5432-16P-4Ks2 Firmware: before dh_nvr5432_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5432_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5432-4Ks2 Firmware: before dh_nvr5432_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5432_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5464-16P-4Ks2 Firmware: before dh_nvr5464_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5464_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5464-4Ks2 Firmware: before dh_nvr5464_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5464_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5816-16P-4Ks2 Firmware: before dh_nvr5816_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5816_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5816-4Ks2 Firmware: before dh_nvr5816_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5816_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5832-16P-4Ks2 Firmware: before dh_nvr5832_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5832_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5832-4Ks2 Firmware: before dh_nvr5832_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5832_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5864-16P-4Ks2 Firmware: before dh_nvr5864_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5864_eng_p_v2.616.0000.0.r.20171102
• Dahuasecurity Nvr5864-4Ks2 Firmware: before dh_nvr5864_eng_p_v2.616.0000.0.r.20171102 — fixed in dh_nvr5864_eng_p_v2.616.0000.0.r.20171102

How to fix

Upgrade to a fixed version: Dahuasecurity Nvr5208-4Ks2 Firmware dh_nvr5208_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5208-8P-4Ks2 Firmware dh_nvr5208_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5216-16P-4Ks2 Firmware dh_nvr5216_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5216-4Ks2 Firmware dh_nvr5216_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5216-8P-4Ks2 Firmware dh_nvr5216_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5224-24P-4Ks2 Firmware dh_nvr5224_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5232-16P-4Ks2 Firmware dh_nvr5232_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5232-4Ks2 Firmware dh_nvr5232_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5232-8P-4Ks2 Firmware dh_nvr5232_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5416-16P-4Ks2 Firmware dh_nvr5416_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5416-4Ks2 Firmware dh_nvr5416_eng_p_v2.616.0000.0.r.20171102; Dahuasecurity Nvr5424-24P-4Ks2 Firmware dh_nvr5424_eng_p_v2.616.0000.0.r.20171102. Check the vendor advisory for mitigations.

References

• http://www.dahuasecurity.com/annoucementsingle/security-advisory--authentication-vulnerability-found-in-some-dahua-nvr_14731_211.html
• http://www.dahuasecurity.com/annoucementsingle/security-advisory--authentication-vulnerability-found-in-some-dahua-nvr_14731_211.html

Get alerted when CVE-2017-9314 or the next vulnerability affects your stack