CVE-2022-45423 - Vulnerability Details

Vendors	Products
Dahuasecurity	Dhi-dss4004-s2 Dhi-dss4004-s2 Firmware Dhi-dss7016d-s2 Dhi-dss7016d-s2 Firmware Dhi-dss7016dr-s2 Dhi-dss7016dr-s2 Firmware Dss Express Dss Professional

Link	Providers
https://www.dahuasecurity.com/support/cybersecurity/details/1137

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-45423", "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad", "assignerShortName": "dahua", "dateUpdated": "2025-04-14T13:00:23.939Z", "dateReserved": "2022-11-14T00:00:00.000Z", "datePublished": "2022-12-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad", "shortName": "dahua", "dateUpdated": "2022-12-27T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited)."}], "affected": [{"vendor": "n/a", "product": "DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2", "versions": [{"version": "V8.0.2, V8.0.4, V8.1", "status": "affected"}]}], "references": [{"url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Missing Authorization"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:09:57.037Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T12:59:47.911295Z", "id": "CVE-2022-45423", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:00:23.939Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-45423 (string)

assignerOrgId : 79ee569e-7d1e-4364-98f0-3a18e2a739ad (string)

assignerShortName : dahua (string)

dateUpdated : 2025-04-14T13:00:23.939Z (string)

dateReserved : 2022-11-14T00:00:00.000Z (string)

datePublished : 2022-12-27T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 79ee569e-7d1e-4364-98f0-3a18e2a739ad (string)

shortName : dahua (string)

dateUpdated : 2022-12-27T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (string)

versions : [ »

0 : { »

version : V8.0.2, V8.0.4, V8.1 (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Missing Authorization (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T14:09:57.037Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-306 (string)

lang : en (string)

description : CWE-306 Missing Authentication for Critical Function (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-14T12:59:47.911295Z (string)

id : CVE-2022-45423 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-14T13:00:23.939Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:09:57.037Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-45423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T12:59:47.911295Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:00:18.346Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2", "versions": [{"status": "affected", "version": "V8.0.2, V8.0.4, V8.1"}]}], "references": [{"url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137"}], "descriptions": [{"lang": "en", "value": "Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad", "shortName": "dahua", "dateUpdated": "2022-12-27T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-45423", "state": "PUBLISHED", "dateUpdated": "2025-04-14T13:00:23.939Z", "dateReserved": "2022-11-14T00:00:00.000Z", "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad", "datePublished": "2022-12-27T00:00:00.000Z", "assignerShortName": "dahua"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T14:09:57.037Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-45423 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-14T12:59:47.911295Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-306 (string)

description : CWE-306 Missing Authentication for Critical Function (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-14T13:00:18.346Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (string)

versions : [ »

0 : { »

status : affected (string)

version : V8.0.2, V8.0.4, V8.1 (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Missing Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 79ee569e-7d1e-4364-98f0-3a18e2a739ad (string)

shortName : dahua (string)

dateUpdated : 2022-12-27T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-45423 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-14T13:00:23.939Z (string)

dateReserved : 2022-11-14T00:00:00.000Z (string)

assignerOrgId : 79ee569e-7d1e-4364-98f0-3a18e2a739ad (string)

datePublished : 2022-12-27T00:00:00.000Z (string)

assignerShortName : dahua (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dahuasecurity:dss_express:7.002.1760000.2:*:*:*:*:*:*:*", "matchCriteriaId": "3884EEA1-1A5A-465D-911A-C1468C48095C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_express:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "546B8C47-C545-4BF6-B62E-F6D7A4EC0B9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_express:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "2FFFFF73-D666-4EFD-BC9C-F35AB0884E63", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_express:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "F79147B7-FBD0-4A5A-81A4-B902366336C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_express:8.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "B4A7BE6D-04EB-40CC-A59E-78922BA310EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_professional:7.002.1760000.2:*:*:*:*:*:*:*", "matchCriteriaId": "BA1F0C70-4274-4910-A645-EC52D1CB3847", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_professional:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "A7812C76-E325-4DDB-BF1F-AA0C37B073F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_professional:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "F6C276F4-260B-4C98-92B7-AD5FD5B6A35C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_professional:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "50990609-E282-4FF0-B7B3-6FF641E1F836", "vulnerable": true}, {"criteria": "cpe:2.3:a:dahuasecurity:dss_professional:8.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "6CE289B1-0442-4F55-9C8B-3B8D1B3F24E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*", "matchCriteriaId": "D729295F-15E2-4B8D-A85C-53CAB6544144", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "266BDE37-4A75-4B7F-9627-DDE6C78FB593", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "7CA557CC-3A2B-40E0-833E-2009B6180DEB", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "E6E8AE26-5271-4BA3-8539-9B7856F5DF84", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:dhi-dss7016d-s2:-:*:*:*:*:*:*:*", "matchCriteriaId": "CCBDDB17-CEDD-45DA-87E0-7F15753AE9BC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*", "matchCriteriaId": "F0F2A1C3-2057-4182-B425-94C3EC1862BE", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "D6042411-429A-48BC-9D21-D8AD84DB11E6", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "11B6BBCD-0A83-4816-84F9-647403DA64F2", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "78D7D57F-36EA-42DB-866F-DC9BCEAD2235", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:dhi-dss7016dr-s2:-:*:*:*:*:*:*:*", "matchCriteriaId": "38A0F44A-CB7D-42EA-A8D7-373F5BD6A963", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:*", "matchCriteriaId": "D4C754C4-1908-4EF2-BB70-4EA730324D98", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "4D060128-197D-4EEC-A486-364B1876A1B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "1E8F32EF-9A87-4807-B3C0-2DC4F17553D1", "vulnerable": true}, {"criteria": "cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "9F9CED99-BAC5-4D7C-B10F-DF16085BC888", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:dhi-dss4004-s2:-:*:*:*:*:*:*:*", "matchCriteriaId": "C8C804BE-2D42-4213-A108-4426F5F0E348", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited)."}, {"lang": "es", "value": "Algunos productos de software de Dahua tienen una vulnerabilidad de solicitud no autenticada de credenciales MQTT. Un atacante puede obtener credenciales MQTT cifradas enviando un paquete manipulado espec\u00edficamente a la interfaz vulnerable (las credenciales no pueden explotarse directamente)."}], "id": "CVE-2022-45423", "lastModified": "2025-04-14T13:15:15.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-27T18:15:10.390", "references": [{"source": "cybersecurity@dahuatech.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dahuasecurity.com/support/cybersecurity/details/1137"}], "sourceIdentifier": "cybersecurity@dahuatech.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_express:7.002.1760000.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 3884EEA1-1A5A-465D-911A-C1468C48095C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_express:8.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 546B8C47-C545-4BF6-B62E-F6D7A4EC0B9A (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_express:8.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 2FFFFF73-D666-4EFD-BC9C-F35AB0884E63 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_express:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : F79147B7-FBD0-4A5A-81A4-B902366336C7 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_express:8.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : B4A7BE6D-04EB-40CC-A59E-78922BA310EF (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_professional:7.002.1760000.2:*:*:*:*:*:*:* (string)

matchCriteriaId : BA1F0C70-4274-4910-A645-EC52D1CB3847 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_professional:8.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : A7812C76-E325-4DDB-BF1F-AA0C37B073F4 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_professional:8.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : F6C276F4-260B-4C98-92B7-AD5FD5B6A35C (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_professional:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 50990609-E282-4FF0-B7B3-6FF641E1F836 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:dahuasecurity:dss_professional:8.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 6CE289B1-0442-4F55-9C8B-3B8D1B3F24E3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:* (string)

matchCriteriaId : D729295F-15E2-4B8D-A85C-53CAB6544144 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 266BDE37-4A75-4B7F-9627-DDE6C78FB593 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 7CA557CC-3A2B-40E0-833E-2009B6180DEB (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016d-s2_firmware:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : E6E8AE26-5271-4BA3-8539-9B7856F5DF84 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:dahuasecurity:dhi-dss7016d-s2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : CCBDDB17-CEDD-45DA-87E0-7F15753AE9BC (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:* (string)

matchCriteriaId : F0F2A1C3-2057-4182-B425-94C3EC1862BE (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : D6042411-429A-48BC-9D21-D8AD84DB11E6 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 11B6BBCD-0A83-4816-84F9-647403DA64F2 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss7016dr-s2_firmware:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 78D7D57F-36EA-42DB-866F-DC9BCEAD2235 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:dahuasecurity:dhi-dss7016dr-s2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 38A0F44A-CB7D-42EA-A8D7-373F5BD6A963 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

3 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:1.001.0000001.2:*:*:*:*:*:*:* (string)

matchCriteriaId : D4C754C4-1908-4EF2-BB70-4EA730324D98 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 4D060128-197D-4EEC-A486-364B1876A1B6 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 1E8F32EF-9A87-4807-B3C0-2DC4F17553D1 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:dahuasecurity:dhi-dss4004-s2_firmware:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 9F9CED99-BAC5-4D7C-B10F-DF16085BC888 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:dahuasecurity:dhi-dss4004-s2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C8C804BE-2D42-4213-A108-4426F5F0E348 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). (string)

}

1 : { »

lang : es (string)

value : Algunos productos de software de Dahua tienen una vulnerabilidad de solicitud no autenticada de credenciales MQTT. Un atacante puede obtener credenciales MQTT cifradas enviando un paquete manipulado específicamente a la interfaz vulnerable (las credenciales no pueden explotarse directamente). (string)

}

]

id : CVE-2022-45423 (string)

lastModified : 2025-04-14T13:15:15.970 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-27T18:15:10.390 (string)

references : [ »

0 : { »

source : cybersecurity@dahuatech.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.dahuasecurity.com/support/cybersecurity/details/1137 (string)

}

]

sourceIdentifier : cybersecurity@dahuatech.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-306 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-306 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object