CVE-2013-3612
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified ...
CVE-2013-3612 is a high vulnerability (CVSS 10.0) in Dahuasecurity Dvr0404hd-a, published September 17, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.3%, the 95th percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 10.3%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
Exploit likelihood
Affected products
- dahuasecurity dvr0404hd-a
- dahuasecurity dvr0404hd-l
- dahuasecurity dvr0404hd-s
- dahuasecurity dvr0404hd-u
- dahuasecurity dvr0404hf-a-e
- dahuasecurity dvr0404hf-al-e
- dahuasecurity dvr0404hf-s-e
- dahuasecurity dvr0404hf-u-e
- dahuasecurity dvr0804
- dahuasecurity dvr0804hd-l
- dahuasecurity dvr0804hd-s
- dahuasecurity dvr0804hf-a-e
Show 53 moreShow less
- dahuasecurity dvr0804hf-al-e
- dahuasecurity dvr0804hf-l-e
- dahuasecurity dvr0804hf-s-e
- dahuasecurity dvr0804hf-u-e
- dahuasecurity dvr1604hd-l
- dahuasecurity dvr1604hd-s
- dahuasecurity dvr1604hf-a-e
- dahuasecurity dvr1604hf-al-e
- dahuasecurity dvr1604hf-l-e
- dahuasecurity dvr1604hf-s-e
- dahuasecurity dvr1604hf-u-e
- dahuasecurity dvr2104c
- dahuasecurity dvr2104h
- dahuasecurity dvr2104hc
- dahuasecurity dvr2104he
- dahuasecurity dvr2108c
- dahuasecurity dvr2108h
- dahuasecurity dvr2108hc
- dahuasecurity dvr2108he
- dahuasecurity dvr2116c
- dahuasecurity dvr2116h
- dahuasecurity dvr2116hc
- dahuasecurity dvr2116he
- dahuasecurity dvr2404hf-s
- dahuasecurity dvr2404lf-al
- dahuasecurity dvr2404lf-s
- dahuasecurity dvr3204hf-s
- dahuasecurity dvr3204lf-al
- dahuasecurity dvr3204lf-s
- dahuasecurity dvr3224l
- dahuasecurity dvr3232l
- dahuasecurity dvr5104c
- dahuasecurity dvr5104h
- dahuasecurity dvr5104he
- dahuasecurity dvr5108c
- dahuasecurity dvr5108h
- dahuasecurity dvr5108he
- dahuasecurity dvr5116c
- dahuasecurity dvr5116h
- dahuasecurity dvr5116he
- dahuasecurity dvr5204a
- dahuasecurity dvr5204l
- dahuasecurity dvr5208a
- dahuasecurity dvr5208l
- dahuasecurity dvr5216a
- dahuasecurity dvr5216l
- dahuasecurity dvr5404
- dahuasecurity dvr5408
- dahuasecurity dvr5416
- dahuasecurity dvr5804
- dahuasecurity dvr5808
- dahuasecurity dvr5816
- dahuasecurity dvr6404lf-s
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit) | 2013-11-18 |
What each source reports
NVD Score used
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
- Record
CVE-2013-3612- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE ListNo score
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
- Record
CVE-2013-3612- Updated
- 2026-11-02
EUVDEUVD-2013-3546No score
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
- Record
EUVD-2013-3546- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3c7g-8x9w-wjqpNo score
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified ...
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.
- Record
GHSA-3c7g-8x9w-wjqp- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.