CVE-2017-9316: Dahuasecurity Ipc-HDBW4X00 Firmware

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.

Affected products

• Dahuasecurity Ipc-HDBW4X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HDBW5X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HDW4300S Firmware: version 2.240.0009.0.r.20131015 only; version 2.400.0000.0.r.20131231 only; version 2.420.0000.0.r.20140419 only; version 2.420.0002.0.r.20140621 only; version 2.420.0002.0.r.20140724 only; version 2.420.0005.0.r.20141205 only; …
• Dahuasecurity Ipc-HDW4X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HDW5X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HF5X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HFW4X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity Ipc-HFW5X00 Firmware: version 2.400.0000.3.r.20150312 only; version 2.420.0006.0.r.20150311 only
• Dahuasecurity NVR11HS Firmware: version 3.210.0000.0.r.20150206 only; version 3.210.0000.1.r.20150420 only; version 3.210.0000.2.r.20150715 only; version 3.210.0000.3.r.20150921 only; version 3.210.0000.5.r.20160409 only; version 3.210.0000.5.r.20160603 only; …

Published 2017-11-27. Last modified 2026-06-17.