Dahuasecurity DVR3204LF-Al vulnerabilities

5 CVEs affecting Dahuasecurity DVR3204LF-Al, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-5754, published 2013-09-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3612, published 2013-09-17. High severity, CVSS 10.0. EPSS: 10.3% chance of exploitation in the next 30 days. Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via…
CVE-2013-3615, published 2013-09-17. High severity, CVSS 7.8. EPSS: 7.7% chance of exploitation in the next 30 days. Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack.
CVE-2013-3614, published 2013-09-17. High severity, CVSS 9.3. EPSS: 7% chance of exploitation in the next 30 days. Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2013-3613, published 2013-09-17. High severity, CVSS 7.8. EPSS: 6.7% chance of exploitation in the next 30 days. Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
CVE-2013-5754, published 2013-09-17. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain…