Unauthenticated ICMP Request Vulnerability in Dahua Software Products
CVE-2022-45434

5.9MEDIUM

Key Information:

Vendor: Dahuasecurity
Status: Dss Professional, Dss Express, Dhi-dss7016d-s2/dhi-dss7016dr-s2, Dhi-dss4004-s2
Vendor: CVE Published:; 27 December 2022

🔔 Create Dahuasecurity Vulnerability Alert

What is CVE-2022-45434?

Dahua software products, particularly the DSS Server, exhibit vulnerability due to unauthenticated and un-throttled ICMP requests. Attackers can exploit this by circumventing firewall access controls to send specially crafted packets, leading to potential ICMP request flooding on the targeted host, which may disrupt network services and compromise the integrity of connected systems.

Affected Version(s)

DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 V8.0.2, V8.0.4, V8.1

References

https://www.dahuasecurity.com/support/cybersecurity/detai...

CVSS V3.1

Score:

5.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 27, 2022
Vulnerability Reserved
Nov 14, 2022

CVE-2022-45434 Data

JSON