Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products.

published 2017-11-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-18251

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction, no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.

Patch / fix

links 1

dahuasecurity.com/annoucementsingle/security-advisory--high-risk-vulnerabili… advisory

Exploit prediction

1.89% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:N/I:P/A:P

Affected products

Dahua Technologies IPC-HDW4300S\NVR11HS\IPC-HFW4X00\IPC-HDW4X00\IPC-HDBW4X00\IPC-HF5X00\IPC-HFW5X00\IPC-HDW5X00\IPC-HDBW5X00\NVR11HS

Classification

Weakness

CWE-287 Improper Authentication

References

dahuasecurity.com /annoucementsingle/security-advisory--high-risk-vulnerability-found-in-dahua-ipc-hdw4300s-and-some-ip-products
patch, vendor-advisory

Sources

CVE List CVE-2017-9316
NVD CVE-2017-9316

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary