Dahuasecurity Ipc-HFW2439M-As-Led-B-s2 Firmware vulnerabilities

4 CVEs affecting Dahuasecurity Ipc-HFW2439M-As-Led-B-s2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-30563, published 2022-06-28.

More from Dahuasecurity.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-30563, published 2022-06-28. High severity, CVSS 7.4. EPSS: 1% chance of exploitation in the next 30 days. When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying the user's login packet.
• CVE-2022-30560, published 2022-06-28. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the…
• CVE-2022-30561, published 2022-06-28. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the user's login packet.
• CVE-2022-30562, published 2022-06-28. Medium severity, CVSS 4.7. EPSS: 0.7% chance of exploitation in the next 30 days. If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the…