Dahua ASI7213X-T1 Unrestricted Upload of File with Dangerous Type (CVE-2022-30560)

high Tenable OT Security Plugin ID 502328

Synopsis

The remote OT asset is affected by a vulnerability.

Description

When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Please see the Dahua security advisory for more information on mitigations for the affected products.

The video surveillance and telecommunication equipment of Dahua Technology has been deemed to pose an unacceptable risk to the national security of the United States. Please see the FCC list of equipment covered by section 2 of The Secure Networks Act.

Plugin Details

Severity: High

ID: 502328

Version: 1.4

Type: remote

Family: Tenable.ot

Published: 7/29/2024

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2022-30560

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:dahuasecurity:ipc-hfw2231t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2239m-as-led-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2439s-sa-led-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2239s-sa-led-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2230e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2531r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2439m-as-led-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231r-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231t-as-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2231m-as-i2-b-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2831r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2531s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2431t-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2831t-zs-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231e-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2431r-zas-s2_firmware, cpe:/o:dahuasecurity:ipc-hfw2230s-s-s2_firmware, cpe:/o:dahuasecurity:ipc-hdbw2231f-as-s2_firmware

Required KB Items: Tenable.ot/DahuaSecurity

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/28/2022

Vulnerability Publication Date: 6/28/2022

Reference Information

CVE: CVE-2022-30560

CWE: 434

ICSA: 22-193-01

Detections

Analytics