CVE-2017-9317

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-23 · updated 2026-06-17

Description

Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device.

Affected products

Dahuasecurity Ipc-Hdbw4Xxx Firmware: before 2.622.0000000.18.r.20171110; before 2.621.0000.28.r.20170912 — fixed in 2.621.0000.28.r.20170912, 2.622.0000000.18.r.20171110
Dahuasecurity Ipc-Hdbw5Xxx Firmware: before 2.622.0000000.18.r.20171110; before 2.621.0000.28.r.20170912 — fixed in 2.621.0000.28.r.20170912, 2.622.0000000.18.r.20171110
Dahuasecurity Xvr5X04 Firmware: before 3.218.0000002.1.r.171229 — fixed in 3.218.0000002.1.r.171229
Dahuasecurity Xvr5X08 Firmware: before 3.218.0000002.1.r.171229 — fixed in 3.218.0000002.1.r.171229
Dahuasecurity Xvr5X16 Firmware: before 3.218.0000002.1.r.171229 — fixed in 3.218.0000002.1.r.171229
Dahuasecurity Xvr7X16 Firmware: before 3.218.0000002.1.r.171229 — fixed in 3.218.0000002.1.r.171229

How to fix

Upgrade to a fixed version: Dahuasecurity Ipc-Hdbw4Xxx Firmware 2.621.0000.28.r.20170912, 2.622.0000000.18.r.20171110; Dahuasecurity Ipc-Hdbw5Xxx Firmware 2.621.0000.28.r.20170912, 2.622.0000000.18.r.20171110; Dahuasecurity Xvr5X04 Firmware 3.218.0000002.1.r.171229; Dahuasecurity Xvr5X08 Firmware 3.218.0000002.1.r.171229; Dahuasecurity Xvr5X16 Firmware 3.218.0000002.1.r.171229; Dahuasecurity Xvr7X16 Firmware 3.218.0000002.1.r.171229. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-9317 or the next vulnerability affects your stack