CVE-2020-9502 Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet...
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dahuasecurity sd6al firmware | < 2019-12 | 2019-12 |
| dahuasecurity sd5a firmware | < 2019-12 | 2019-12 |
| dahuasecurity sd1a firmware | < 2019-12 | 2019-12 |
| dahuasecurity ptz1a firmware | < 2019-12 | 2019-12 |
| dahuasecurity sd50 firmware | < 2019-12 | 2019-12 |
| dahuasecurity sd52c firmware | < 2019-12 | 2019-12 |
| dahuasecurity ipc-hx5842h firmware | < 2019-12 | 2019-12 |
| dahuasecurity ipc-hx7842h firmware | < 2019-12 | 2019-12 |
| dahuasecurity ipc-hx2xxx firmware | < 2019-12 | 2019-12 |
| dahuasecurity ipc-hxxx5x4x firmware | < 2019-12 | 2019-12 |
| dahuasecurity n42b1p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n42b2p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n42b3p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n52a4p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n54a4p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n52b2p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n52b5p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n52b3p firmware | < 2019-12 | 2019-12 |
| dahuasecurity n54b2p firmware | < 2019-12 | 2019-12 |
| dahuasecurity ipc-hdbw1320e-w firmware | < 2019-12 | 2019-12 |
References
- www.dahuasecurity.com vendor-advisory