Vulnerability Description
The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amcrest | Ip2M-841B Firmware | 2.520.ac00.18.r |
| Amcrest | Ip2M-841B | - |
| Dahua | Dh-Ipc-Hx863X | < 2018-05-18 |
| Dahua | Dh-Ipc-Hx883X | < 2018-05-18 |
| Dahua | Dh-Sd4Xxxxx | < 2018-05-18 |
| Dahua | Dh-Sd5Xxxxx | < 2018-05-18 |
| Dahua | Dh-Sd6Xxxxx | < 2018-05-18 |
| Dahua | Ipc-Hx4X3X | < 2018-05-18 |
| Dahua | Ipc-Hx5X3X | < 2018-05-18 |
| Dahua | Ipc-Xxbxx | < 2018-05-18 |
| Dahua | Nvr2Xxx-4Ks2 | < 2018-05-18 |
| Dahua | Nvr4Xxx-4Ks2 | < 2018-05-18 |
| Dahua | Nvr5Xxx-4Ks2 | < 2018-05-18 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/153813/Amcrest-Cameras-2.520.AC00.18.R-UnauExploitThird Party AdvisoryVDB Entry
- https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02
- https://www.dahuasecurity.com/support/cybersecurity/details/627?us
- https://www.tenable.com/security/research/tra-2019-36ExploitThird Party Advisory
- http://packetstormsecurity.com/files/153813/Amcrest-Cameras-2.520.AC00.18.R-UnauExploitThird Party AdvisoryVDB Entry
- https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02
- https://www.dahuasecurity.com/support/cybersecurity/details/627?us
- https://www.tenable.com/security/research/tra-2019-36ExploitThird Party Advisory
FAQ
What is CVE-2019-3948?
CVE-2019-3948 is a vulnerability with a CVSS score of 7.5 (HIGH). The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX ...
How severe is CVE-2019-3948?
CVE-2019-3948 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3948?
Check the references section above for vendor advisories and patch information. Affected products include: Amcrest Ip2M-841B Firmware, Amcrest Ip2M-841B, Dahua Dh-Ipc-Hx863X, Dahua Dh-Ipc-Hx883X, Dahua Dh-Sd4Xxxxx.