CVE-2017-6342
📋 TL;DR
This vulnerability allows attackers to bypass authentication in Dahua SmartPSS software by automatically logging in as admin when the software is launched. This affects users of specific Dahua NVR devices and SmartPSS software versions, enabling unauthorized access to sensitive information without requiring password knowledge.
💻 Affected Systems
- Dahua DHI-HCVR7216A-S3 NVR
- Dahua SmartPSS Software
📦 What is this software?
Camera Firmware by Dahuasecurity
Nvr Firmware by Dahuasecurity
Smartpss Firmware by Dahuasecurity
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of surveillance systems, unauthorized access to live camera feeds, configuration tampering, and potential access to other connected systems.
Likely Case
Unauthorized viewing of surveillance footage, access to sensitive camera configurations, and potential credential harvesting from the system.
If Mitigated
Limited to isolated network segments with no sensitive data exposure.
🎯 Exploit Status
Exploitation requires network access to the SmartPSS software and involves sniffing network traffic during the automatic login process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SmartPSS versions after 1.16.1
Vendor Advisory: Not publicly documented by Dahua
Restart Required: Yes
Instructions:
1. Update SmartPSS software to latest version. 2. Update NVR firmware to latest version. 3. Update camera firmware to latest version. 4. Restart all affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Dahua systems from untrusted networks
Disable SmartPSS
windowsRemove or disable SmartPSS software if not required
🧯 If You Can't Patch
- Segment Dahua devices on isolated VLAN with strict firewall rules
- Monitor network traffic for unauthorized access attempts to SmartPSS
🔍 How to Verify
Check if Vulnerable:
Check SmartPSS version (Help > About). If version is 1.16.1 or earlier, the system is vulnerable. Monitor network traffic during SmartPSS launch for automatic admin login.Check Version:
In SmartPSS: Help > AboutVerify Fix Applied:
After updating, verify SmartPSS version is newer than 1.16.1. Test that automatic admin login no longer occurs during launch.📡 Detection & Monitoring
Log Indicators:
- Unauthorized login attempts
- Multiple admin sessions from unusual IPs
- SmartPSS launch events
Network Indicators:
- Traffic to SmartPSS default ports (37777, 37778)
- Admin authentication without password entry
SIEM Query:
source="network_traffic" dest_port=37777 OR dest_port=37778 AND (event="authentication" AND user="admin" AND password="")