CVE-2019-9677
Estado: ModificadaCrítica (9.8)—
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.14%
- Percentil entre todas las CVEs puntuadas: 66
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
Dahuasecurity — Ipc-hdbw4x2x FirmwareDahuasecurity — Ipc-hdw1x2x FirmwareDahuasecurity — Ipc-hdw2x2x FirmwareDahuasecurity — Ipc-hdw4x2x FirmwareDahuasecurity — Ipc-hdw5x2x FirmwareDahuasecurity — Ipc-hfw1x2x FirmwareDahuasecurity — Ipc-hfw2x2x FirmwareDahuasecurity — Ipc-hfw4x2x FirmwareDahuasecurity — Ipc-hfw5x2x Firmware
CWE
- CWE-120
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-9677",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@dahuatech.com",
"affectedData": [
{
"vendor": "Dahua Technology",
"product": "IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X",
"versions": [
{
"status": "affected",
"version": "Versions which Build time before August 18 2019"
}
]
}
]
}
],
"published": "2019-09-18T19:15:10.297",
"references": [
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/637",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/637",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019."
},
{
"lang": "es",
"value": "Los campos específicos de la interfaz CGI de algunos productos Dahua no están estrictamente verificados, un atacante puede causar un desbordamiento del búfer mediante la construcción de paquetes maliciosos. Entre los productos afectados se incluyen: IPC-HDW1X2X, IPC-HFW1X2X, IPC-HDW2X2X, IPC-HFW2X2X, IPC-HDW4X2X, IPC-HFW4X2X, IPC-HDBW4X2X, IPC-HDW5X2X, IPC-HX, para versiones cuyo tiempo de Compilación es antes del 18 de Agosto del 2019."
}
],
"lastModified": "2026-06-17T02:44:10.037",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw1x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6E2D121-6734-4A00-B591-823AE8E33130",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw1x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DEAAFB9C-0BFE-413A-A13B-CB485FC82BF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw1x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D31CD26D-5C5A-4A98-B515-58A26C120E50",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw1x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "528FE4A4-08D8-4A8F-8437-4606C769CC90"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw2x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45D99315-300F-4FD9-8161-13EACD2B66FC",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw2x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "23A12ECC-377E-48E3-9AD2-3296E9581D16"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw2x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2561607-9770-4C23-89DD-50B487DA6CBE",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw2x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BC3F17B6-FFF9-4118-A7A4-262D3D126953"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC4CEABA-35D5-4785-A8CA-7216F22A5012",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E8460FAC-6AED-4D6F-A6DB-84A4CC278CA3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D38C378-9D10-48A8-A8EE-FDBB9BE179CD",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "08277A58-AE74-43E3-BFD9-10ACFF3180D8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdbw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC289503-8A59-42A5-97A8-932A1BDA4F00",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdbw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C9CEDA2A-9E81-46B0-BCBE-CAAB7E050F44"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw5x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E56F8D5-66DA-4186-AF7E-F2691E4A68C3",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw5x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4A2CBF7-C132-4EC2-9243-9892784516C1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw5x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD926583-99C6-4543-AAE5-CD0DFF0007C5",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw5x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7924CDDA-609E-4E9A-A8D7-5A5E2973394A"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@dahuatech.com"
}