Vulnerability · Published May 13, 2020 · Assigned by dahua
CVE-2020-9501
Medium 5.5
In plain English
A medium-severity security flaw in Web P2P control,P2P plartform server,client tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Web P2P control,P2P plartform server,client tools | Versions which Build time before April,2020 |
References
- https://www.dahuasecurity.com/support/cybersecurity/details/757 x_refsource_MISC