{"id":"CVE-2013-3612","aliases":["EUVD-2013-3546","GHSA-3c7g-8x9w-wjqp"],"status":"published","title":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified ...","description":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified \"backdoor\" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10298,"percentile":0.95729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-255"],"published":"2013-09-17T10:00:00Z","modified":"2026-06-16T23:55:30Z","exploits":[{"source":"exploitdb","id":"EDB-29673","title":"Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)","type":"webapps","platform":"hardware","date":"2013-11-18","url":"https://www.exploit-db.com/exploits/29673"}],"products":[{"vendor":"dahuasecurity","product":"dvr0404hd-a"},{"vendor":"dahuasecurity","product":"dvr0404hd-l"},{"vendor":"dahuasecurity","product":"dvr0404hd-s"},{"vendor":"dahuasecurity","product":"dvr0404hd-u"},{"vendor":"dahuasecurity","product":"dvr0404hf-a-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-al-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-s-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-u-e"},{"vendor":"dahuasecurity","product":"dvr0804"},{"vendor":"dahuasecurity","product":"dvr0804hd-l"},{"vendor":"dahuasecurity","product":"dvr0804hd-s"},{"vendor":"dahuasecurity","product":"dvr0804hf-a-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-al-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-l-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-s-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-u-e"},{"vendor":"dahuasecurity","product":"dvr1604hd-l"},{"vendor":"dahuasecurity","product":"dvr1604hd-s"},{"vendor":"dahuasecurity","product":"dvr1604hf-a-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-al-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-l-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-s-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-u-e"},{"vendor":"dahuasecurity","product":"dvr2104c"},{"vendor":"dahuasecurity","product":"dvr2104h"},{"vendor":"dahuasecurity","product":"dvr2104hc"},{"vendor":"dahuasecurity","product":"dvr2104he"},{"vendor":"dahuasecurity","product":"dvr2108c"},{"vendor":"dahuasecurity","product":"dvr2108h"},{"vendor":"dahuasecurity","product":"dvr2108hc"},{"vendor":"dahuasecurity","product":"dvr2108he"},{"vendor":"dahuasecurity","product":"dvr2116c"},{"vendor":"dahuasecurity","product":"dvr2116h"},{"vendor":"dahuasecurity","product":"dvr2116hc"},{"vendor":"dahuasecurity","product":"dvr2116he"},{"vendor":"dahuasecurity","product":"dvr2404hf-s"},{"vendor":"dahuasecurity","product":"dvr2404lf-al"},{"vendor":"dahuasecurity","product":"dvr2404lf-s"},{"vendor":"dahuasecurity","product":"dvr3204hf-s"},{"vendor":"dahuasecurity","product":"dvr3204lf-al"},{"vendor":"dahuasecurity","product":"dvr3204lf-s"},{"vendor":"dahuasecurity","product":"dvr3224l"},{"vendor":"dahuasecurity","product":"dvr3232l"},{"vendor":"dahuasecurity","product":"dvr5104c"},{"vendor":"dahuasecurity","product":"dvr5104h"},{"vendor":"dahuasecurity","product":"dvr5104he"},{"vendor":"dahuasecurity","product":"dvr5108c"},{"vendor":"dahuasecurity","product":"dvr5108h"},{"vendor":"dahuasecurity","product":"dvr5108he"},{"vendor":"dahuasecurity","product":"dvr5116c"},{"vendor":"dahuasecurity","product":"dvr5116h"},{"vendor":"dahuasecurity","product":"dvr5116he"},{"vendor":"dahuasecurity","product":"dvr5204a"},{"vendor":"dahuasecurity","product":"dvr5204l"},{"vendor":"dahuasecurity","product":"dvr5208a"},{"vendor":"dahuasecurity","product":"dvr5208l"},{"vendor":"dahuasecurity","product":"dvr5216a"},{"vendor":"dahuasecurity","product":"dvr5216l"},{"vendor":"dahuasecurity","product":"dvr5404"},{"vendor":"dahuasecurity","product":"dvr5408"},{"vendor":"dahuasecurity","product":"dvr5416"},{"vendor":"dahuasecurity","product":"dvr5804"},{"vendor":"dahuasecurity","product":"dvr5808"},{"vendor":"dahuasecurity","product":"dvr5816"},{"vendor":"dahuasecurity","product":"dvr6404lf-s"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/800094","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3612"},{"url":"https://github.com/advisories/GHSA-3c7g-8x9w-wjqp"}],"sources":{"cve":[{"id":"CVE-2013-3612","description":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified \"backdoor\" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.","status":"published","published":"2013-09-17T10:00:00Z","modified":"2024-09-16T22:44:59.973Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3546","description":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified \"backdoor\" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.","status":"published","published":"2013-09-17T10:00:00Z","modified":"2024-09-16T22:44:59Z","updated_at":"2026-11-03T00:55:00.150098Z"}],"ghsa":[{"id":"GHSA-3c7g-8x9w-wjqp","title":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified ...","description":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified \"backdoor\" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.","status":"published","published":"2022-05-17T05:04:45Z","modified":"2023-01-28T05:03:09Z","updated_at":"2026-11-02T14:43:55.102378Z"}],"nvd":[{"id":"CVE-2013-3612","description":"Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified \"backdoor\" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving (a) ActiveX, (b) a standalone client, or (c) unknown other vectors.","status":"published","published":"2013-09-17T12:04:24.743Z","modified":"2026-06-16T23:55:30.707Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:02:35.248411Z"}]}}