CVE-2017-9316

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-93178.8Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to creden CVE-2017-93248.8In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is CVE-2017-93257.5The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.CVE-2017-93267.5The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed CVE-2017-93276.5Secret data of processes managed by CM is not secured by file permissions.CVE-2017-93289.8Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execu CVE-2017-93305.6QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of ser CVE-2017-93315.4The Agenda component in Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Utils/RecordBrowser CVE-2017-93326.1The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the CVE-2017-93338.8OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, w CVE-2017-93347.5An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to CVE-2017-93366.1The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.