CVE-2017-6343

What it actually does

The web interface accepts the MD5 hash of the admin password in place of the plaintext password, allowing authentication without knowledge of the actual password.

Why it matters to the business

Attackers can gain full remote administrative access to affected video surveillance devices, enabling unauthorized viewing, control, or tampering with camera feeds and recordings.

How an attack unfolds

An attacker first obtains the MD5 hash of the admin account (via prior information disclosure or other means), then submits the hash directly to the web login endpoint; successful authentication grants complete administrative control over the NVR or camera.

How to fix it

Apply the vendor-supplied firmware or software updates that enforce proper password verification; specific fixed versions include imagemagick/imagemagick6 (GIT) 4bae9bed8a79e031884ca9a4681dce89dbd26855, Debian 11/12/13 packages 8:6.9.6.2+dfsg-2, Ubuntu 14.04 8:6.7.7.10-6ubuntu3.2, and Ubuntu 16.04 8:6.8.9.9-7ubuntu5.2.

How to confirm the fix worked

Confirm the running firmware or software version matches or exceeds the listed fixed releases and test that MD5-hash-only login attempts are rejected.

Typical attack path

1. Acquire MD5 admin hash through information disclosure or prior compromise
2. Craft authentication request containing the MD5 hash instead of plaintext password
3. Submit request to the device web interface
4. Obtain valid session and full administrative access

How to detect it

Review web server and application logs on Dahua devices for authentication attempts that contain only an MD5 hash value rather than a plaintext password; examine any successful admin sessions originating from unexpected sources.

What your security team should do

• Immediately upgrade all affected Dahua devices and SmartPSS installations to the listed fixed versions
• Restrict web interface access to trusted networks until patches are applied
• Audit logs for any successful logins using non-standard authentication methods
• Monitor for subsequent exploitation given the high EPSS score and multi-year exposure window