Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Dahua DVR devices can be accessed remotely via UPnP

CVE-2013-3613 · published 13 years ago
Summary

Several Dahua DVR models (dvr0404hd-a, dvr0404hd-l, dvr0404hd-s, dvr0404hd-u, dvr0404hf-a-e) do not properly limit UPnP requests, allowing an attacker to replay messages and reach the Telnet service. This could let an outsider gain command‑line access to the recorder. Apply the latest firmware updates and consider disabling UPnP and Telnet if they are not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dahuasecurity dvr0404hd-a All versions
cpe:2.3:h:dahuasecurity:dvr0404hd-a:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hd-l All versions
cpe:2.3:h:dahuasecurity:dvr0404hd-l:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hd-s All versions
cpe:2.3:h:dahuasecurity:dvr0404hd-s:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hd-u All versions
cpe:2.3:h:dahuasecurity:dvr0404hd-u:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hf-a-e All versions
cpe:2.3:h:dahuasecurity:dvr0404hf-a-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hf-al-e All versions
cpe:2.3:h:dahuasecurity:dvr0404hf-al-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hf-s-e All versions
cpe:2.3:h:dahuasecurity:dvr0404hf-s-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0404hf-u-e All versions
cpe:2.3:h:dahuasecurity:dvr0404hf-u-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0804 All versions
cpe:2.3:h:dahuasecurity:dvr0804:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hd-l All versions
cpe:2.3:h:dahuasecurity:dvr0804hd-l:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hd-s All versions
cpe:2.3:h:dahuasecurity:dvr0804hd-s:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hf-a-e All versions
cpe:2.3:h:dahuasecurity:dvr0804hf-a-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hf-al-e All versions
cpe:2.3:h:dahuasecurity:dvr0804hf-al-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hf-l-e All versions
cpe:2.3:h:dahuasecurity:dvr0804hf-l-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hf-s-e All versions
cpe:2.3:h:dahuasecurity:dvr0804hf-s-e:-:*:*:*:*:*:*:*
dahuasecurity dvr0804hf-u-e All versions
cpe:2.3:h:dahuasecurity:dvr0804hf-u-e:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hd-l All versions
cpe:2.3:h:dahuasecurity:dvr1604hd-l:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hd-s All versions
cpe:2.3:h:dahuasecurity:dvr1604hd-s:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hf-a-e All versions
cpe:2.3:h:dahuasecurity:dvr1604hf-a-e:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hf-al-e All versions
cpe:2.3:h:dahuasecurity:dvr1604hf-al-e:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hf-l-e All versions
cpe:2.3:h:dahuasecurity:dvr1604hf-l-e:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hf-s-e All versions
cpe:2.3:h:dahuasecurity:dvr1604hf-s-e:-:*:*:*:*:*:*:*
dahuasecurity dvr1604hf-u-e All versions
cpe:2.3:h:dahuasecurity:dvr1604hf-u-e:-:*:*:*:*:*:*:*
dahuasecurity dvr2104c All versions
cpe:2.3:h:dahuasecurity:dvr2104c:-:*:*:*:*:*:*:*
dahuasecurity dvr2104h All versions
cpe:2.3:h:dahuasecurity:dvr2104h:-:*:*:*:*:*:*:*
dahuasecurity dvr2104hc All versions
cpe:2.3:h:dahuasecurity:dvr2104hc:-:*:*:*:*:*:*:*
dahuasecurity dvr2104he All versions
cpe:2.3:h:dahuasecurity:dvr2104he:-:*:*:*:*:*:*:*
dahuasecurity dvr2108c All versions
cpe:2.3:h:dahuasecurity:dvr2108c:-:*:*:*:*:*:*:*
dahuasecurity dvr2108h All versions
cpe:2.3:h:dahuasecurity:dvr2108h:-:*:*:*:*:*:*:*
dahuasecurity dvr2108hc All versions
cpe:2.3:h:dahuasecurity:dvr2108hc:-:*:*:*:*:*:*:*
dahuasecurity dvr2108he All versions
cpe:2.3:h:dahuasecurity:dvr2108he:-:*:*:*:*:*:*:*
dahuasecurity dvr2116c All versions
cpe:2.3:h:dahuasecurity:dvr2116c:-:*:*:*:*:*:*:*
dahuasecurity dvr2116h All versions
cpe:2.3:h:dahuasecurity:dvr2116h:-:*:*:*:*:*:*:*
dahuasecurity dvr2116hc All versions
cpe:2.3:h:dahuasecurity:dvr2116hc:-:*:*:*:*:*:*:*
dahuasecurity dvr2116he All versions
cpe:2.3:h:dahuasecurity:dvr2116he:-:*:*:*:*:*:*:*
dahuasecurity dvr2404hf-s All versions
cpe:2.3:h:dahuasecurity:dvr2404hf-s:-:*:*:*:*:*:*:*
dahuasecurity dvr2404lf-al All versions
cpe:2.3:h:dahuasecurity:dvr2404lf-al:-:*:*:*:*:*:*:*
dahuasecurity dvr2404lf-s All versions
cpe:2.3:h:dahuasecurity:dvr2404lf-s:-:*:*:*:*:*:*:*
dahuasecurity dvr3204hf-s All versions
cpe:2.3:h:dahuasecurity:dvr3204hf-s:-:*:*:*:*:*:*:*
dahuasecurity dvr3204lf-al All versions
cpe:2.3:h:dahuasecurity:dvr3204lf-al:-:*:*:*:*:*:*:*
dahuasecurity dvr3204lf-s All versions
cpe:2.3:h:dahuasecurity:dvr3204lf-s:-:*:*:*:*:*:*:*
dahuasecurity dvr3224l All versions
cpe:2.3:h:dahuasecurity:dvr3224l:-:*:*:*:*:*:*:*
dahuasecurity dvr3232l All versions
cpe:2.3:h:dahuasecurity:dvr3232l:-:*:*:*:*:*:*:*
dahuasecurity dvr5104c All versions
cpe:2.3:h:dahuasecurity:dvr5104c:-:*:*:*:*:*:*:*
dahuasecurity dvr5104h All versions
cpe:2.3:h:dahuasecurity:dvr5104h:-:*:*:*:*:*:*:*
dahuasecurity dvr5104he All versions
cpe:2.3:h:dahuasecurity:dvr5104he:-:*:*:*:*:*:*:*
dahuasecurity dvr5108c All versions
cpe:2.3:h:dahuasecurity:dvr5108c:-:*:*:*:*:*:*:*
dahuasecurity dvr5108h All versions
cpe:2.3:h:dahuasecurity:dvr5108h:-:*:*:*:*:*:*:*
dahuasecurity dvr5108he All versions
cpe:2.3:h:dahuasecurity:dvr5108he:-:*:*:*:*:*:*:*
dahuasecurity dvr5116c All versions
cpe:2.3:h:dahuasecurity:dvr5116c:-:*:*:*:*:*:*:*
Showing 50 of 65. Show the rest
VendorProductAffected versions
dahuasecurity dvr5116h All versions
cpe:2.3:h:dahuasecurity:dvr5116h:-:*:*:*:*:*:*:*
dahuasecurity dvr5116he All versions
cpe:2.3:h:dahuasecurity:dvr5116he:-:*:*:*:*:*:*:*
dahuasecurity dvr5204a All versions
cpe:2.3:h:dahuasecurity:dvr5204a:-:*:*:*:*:*:*:*
dahuasecurity dvr5204l All versions
cpe:2.3:h:dahuasecurity:dvr5204l:-:*:*:*:*:*:*:*
dahuasecurity dvr5208a All versions
cpe:2.3:h:dahuasecurity:dvr5208a:-:*:*:*:*:*:*:*
dahuasecurity dvr5208l All versions
cpe:2.3:h:dahuasecurity:dvr5208l:-:*:*:*:*:*:*:*
dahuasecurity dvr5216a All versions
cpe:2.3:h:dahuasecurity:dvr5216a:-:*:*:*:*:*:*:*
dahuasecurity dvr5216l All versions
cpe:2.3:h:dahuasecurity:dvr5216l:-:*:*:*:*:*:*:*
dahuasecurity dvr5404 All versions
cpe:2.3:h:dahuasecurity:dvr5404:-:*:*:*:*:*:*:*
dahuasecurity dvr5408 All versions
cpe:2.3:h:dahuasecurity:dvr5408:-:*:*:*:*:*:*:*
dahuasecurity dvr5416 All versions
cpe:2.3:h:dahuasecurity:dvr5416:-:*:*:*:*:*:*:*
dahuasecurity dvr5804 All versions
cpe:2.3:h:dahuasecurity:dvr5804:-:*:*:*:*:*:*:*
dahuasecurity dvr5808 All versions
cpe:2.3:h:dahuasecurity:dvr5808:-:*:*:*:*:*:*:*
dahuasecurity dvr5816 All versions
cpe:2.3:h:dahuasecurity:dvr5816:-:*:*:*:*:*:*:*
dahuasecurity dvr6404lf-s All versions
cpe:2.3:h:dahuasecurity:dvr6404lf-s:-:*:*:*:*:*:*:*
Original advisory text
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
7% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published17 Sep 2013
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-3613 · NVD
Track software like this
Free during beta