Stack-based buffer overflow in Dahua IP cameras Sonia - CVE-2017-3223
Published: August 2, 2017
Vulnerability identifier: #VU7667
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3223
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to improper validation of input data length for the 'password' field of the web interface. A remote attacker can submit a specially crafted POST request to the IP camera's Sonia web interface, trigger stack-based buffer overflow and possibly execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to improper validation of input data length for the 'password' field of the web interface. A remote attacker can submit a specially crafted POST request to the IP camera's Sonia web interface, trigger stack-based buffer overflow and possibly execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Dahua IP cameras Sonia
How to mitigate CVE-2017-3223
Update to version DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621.