CVE-2019-9681
Estado: ModificadaMedia (5.3)—
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.78%
- Percentil entre todas las CVEs puntuadas: 55
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
Dahuasecurity — Ipc-hdbw4x2x FirmwareDahuasecurity — Ipc-hdw1x2x FirmwareDahuasecurity — Ipc-hdw2x2x FirmwareDahuasecurity — Ipc-hdw4x2x FirmwareDahuasecurity — Ipc-hdw5x2x FirmwareDahuasecurity — Ipc-hfw1x2x FirmwareDahuasecurity — Ipc-hfw2x2x FirmwareDahuasecurity — Ipc-hfw4x2x FirmwareDahuasecurity — Ipc-hfw5x2x Firmware
CWE
- CWE-311
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-9681",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@dahuatech.com",
"affectedData": [
{
"vendor": "Dahua",
"product": "IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X",
"versions": [
{
"status": "affected",
"version": "Versions which Build time before August 18 2019"
}
]
}
]
}
],
"published": "2019-09-17T17:15:12.707",
"references": [
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/637",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/637",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-311"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019."
},
{
"lang": "es",
"value": "La información de actualización en línea en algunos paquetes de firmware de productos Dahua no está encriptada. Los atacantes pueden obtener esta información mediante el análisis de paquetes de firmware por medios específicos. Los productos afectados incluyen: IPC-HDW1X2X, IPC-HFW1X2X, IPC-HDW2X2X, IPC-HFW2X2X, IPC-HDW4X2X, IPC-HFW4X2X, IPC-HDBW4X2X, IPC-HDW5X2X, IPC-HX2, para versiones cuyo tiempo de compilación es antes del 18 de agosto de 2019."
}
],
"lastModified": "2026-06-17T02:44:10.467",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw1x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6E2D121-6734-4A00-B591-823AE8E33130",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw1x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DEAAFB9C-0BFE-413A-A13B-CB485FC82BF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw1x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D31CD26D-5C5A-4A98-B515-58A26C120E50",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw1x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "528FE4A4-08D8-4A8F-8437-4606C769CC90"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw2x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45D99315-300F-4FD9-8161-13EACD2B66FC",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw2x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "23A12ECC-377E-48E3-9AD2-3296E9581D16"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw2x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2561607-9770-4C23-89DD-50B487DA6CBE",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw2x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BC3F17B6-FFF9-4118-A7A4-262D3D126953"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC4CEABA-35D5-4785-A8CA-7216F22A5012",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E8460FAC-6AED-4D6F-A6DB-84A4CC278CA3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D38C378-9D10-48A8-A8EE-FDBB9BE179CD",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "08277A58-AE74-43E3-BFD9-10ACFF3180D8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdbw4x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC289503-8A59-42A5-97A8-932A1BDA4F00",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdbw4x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C9CEDA2A-9E81-46B0-BCBE-CAAB7E050F44"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdw5x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E56F8D5-66DA-4186-AF7E-F2691E4A68C3",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdw5x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4A2CBF7-C132-4EC2-9243-9892784516C1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hfw5x2x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD926583-99C6-4543-AAE5-CD0DFF0007C5",
"versionEndExcluding": "2019-08-18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hfw5x2x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7924CDDA-609E-4E9A-A8D7-5A5E2973394A"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@dahuatech.com"
}