Dahua ASI7213X-T1 Generation of Error Message Containing Sensitive Information (CVE-2022-30562)

medium Tenable OT Security Plugin ID 502342

Synopsis

The remote OT asset is affected by a vulnerability.

Description

If the user enables the https function on the device, an attacker can modify the user's request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Please see the Dahua security advisory for more information on mitigations for the affected products.

The video surveillance and telecommunication equipment of Dahua Technology has been deemed to pose an unacceptable risk to the national security of the United States. Please see the FCC list of equipment covered by section 2 of The Secure Networks Act.

Plugin Details

Severity: Medium

ID: 502342

Version: 1.4

Type: remote

Family: Tenable.ot

Published: 7/29/2024

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2022-30562

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:dahuasecurity:ipc-hfw2231t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2239m-as-led-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2439s-sa-led-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2239s-sa-led-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2230e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2439m-as-led-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231m-as-i2-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2230s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231f-as-s2_firmware

Required KB Items: Tenable.ot/DahuaSecurity

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/28/2022

Vulnerability Publication Date: 6/28/2022

Reference Information

CVE: CVE-2022-30562

CWE: 601

ICSA: 22-193-01

Detections

Analytics