CWE Code: 922
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Insecure Storage of Sensitive Information
Summary: dahua ip camera devices 3.200.0001.6 can be exploited via these steps: 1. use the default low-privilege credentials to list all users via a request to a certain uri. 2. login to the ip camera with admin credentials so as to obtain full control of the target ip camera. during exploitation, the first json object encountered has a "component error: login challenge!" message. the second json object encountered has a result indicating a successful admin login.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-03-30
Last Modified Date: 2019-10-03