CVE-2017-6341 describes a critical information disclosure vulnerability in Dahua DHI-HCVR7216A-S3 devices, affecting specific NVR, Camera, and SmartPSS firmware versions. The vulnerability allows cleartext passwords to be transmitted in response to various application requests, enabling remote attackers to intercept sensitive authentication credentials via network sniffing. With a CVSS score of 5.9 (Medium), this flaw has a high confidentiality impact due to the exposure of credentials, but does not affect integrity or availability. While there is no known active exploitation, public exploit code, or significant community discussion, the potential for unauthorized access to surveillance systems remains a concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.400.0000.28.rCPE matchmatch criteria | cpe:2.3:o:dahuasecurity:camera_firmware:2.400.0000.28.r:*:*:*:*:*:*:* | ||
3.210.0001.10CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:nvr_firmware:3.210.0001.10:*:*:*:*:*:*:* | ||
1.16.1CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:smartpss_firmware:1.16.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.