CVE-2024-13130
CVE-2024-13130 is a path traversal vulnerability in Dahua IP cameras that could allow unauthorized access to sensitive files. The vulnerability affects the Web Interface of Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S devices up to version 20241222. An attacker could potentially exploit this vulnerability by manipulating the file path in the ../mtd/Config/Sha1Account1 file, leading to unauthorized file access. While the CVSS score is 4.3, indicating a medium severity, the SOCRadar Vulnerability Risk Score (SVRS) is 45, suggesting a moderate level of risk. The fact that this exploit is 'In The Wild' means active exploitation is possible. This vulnerability highlights the importance of keeping Dahua IP camera firmware up to date to mitigate potential security risks. Due to the potential for unauthorized file access, organizations should prioritize patching this vulnerability to prevent potential data breaches or system compromise.
Description
CVE-2024-13130 affects Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z, and IPC-HDW1200S devices up to firmware version 20241222. The vulnerability allows attackers to exploit a path traversal flaw in the Web Interface component, specifically in the ../mtd/Config/Sha1Account1 file, enabling them to access and potentially modify sensitive data within the device. The vulnerability is rated as problematic with a CVSS score of 4.3, and an SVRS score of 43. While the SVRS score is not critical, the vulnerability has been reported as being exploited "In The Wild," making it a significant concern.
Key Insights
- Exploitation: The CVE-2024-13130 vulnerability is actively exploited by attackers in the wild, highlighting the immediate need for mitigation.
- Path Traversal: Attackers can exploit this vulnerability to bypass directory restrictions and gain unauthorized access to critical system files and potentially sensitive data.
- Remote Exploitation: The vulnerability can be triggered remotely, meaning attackers do not need physical access to the affected devices.
- Vendor Response: Despite the vulnerability's seriousness and public disclosure, Dahua has not yet responded to the issue, emphasizing the urgency for users to take action independently.
Mitigation Strategies
- Firmware Updates: Immediately update the affected Dahua devices to the latest firmware version, if available, to patch the vulnerability.
- Network Segmentation: Isolate affected devices from critical networks to limit the impact of a successful attack.
- Firewall Rules: Configure robust firewall rules to block access to the vulnerable file and other sensitive directories.
- Access Control: Implement strong access control measures to prevent unauthorized access to the device's web interface and restrict access to critical functions.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.