Stack-based buffer overflow in Dahua IP cameras Sonia - CVE-2017-3223
Published: August 2, 2017
Vulnerability identifier: #VU7667
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2017-3223
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Dahua Technology
Affected software:
Dahua IP cameras Sonia
Dahua IP cameras Sonia
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to improper validation of input data length for the 'password' field of the web interface. A remote attacker can submit a specially crafted POST request to the IP camera's Sonia web interface, trigger stack-based buffer overflow and possibly execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to improper validation of input data length for the 'password' field of the web interface. A remote attacker can submit a specially crafted POST request to the IP camera's Sonia web interface, trigger stack-based buffer overflow and possibly execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
How to mitigate CVE-2017-3223
Update to version DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621.