CVE-2024-39944

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770 CWE-20

Affected software

Vendor	Product	Versions
Dahua	IPC-HX8XXX and NVR4XXX	IPC-HX8XXX and NVR4XXX Versions which Build time before 2024/2/2
dahuasecurity	nvr4832-i	< 2024.2.2
dahuasecurity	ipc-hf8xxx_firmware	< 2024.2.2
dahuasecurity	ipc-hfw8xxx	< 2024.2.2

References

https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768Vendor Advisory

Timeline

Published: Jul 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-399454.9A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefu CVE-2024-399467.2A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefull CVE-2024-399476.5A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefull CVE-2024-399487.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, c CVE-2024-399497.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, c CVE-2024-39952.0In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.CVE-2024-399509.8A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to CVE-2024-399546.3CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker CVE-2024-39963.5The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2024-399629.8D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability i CVE-2024-399638.0AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered CVE-2024-399676.5Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command.