{"id":"CVE-2013-5754","aliases":["EUVD-2013-5590","GHSA-hprw-r36q-86cc"],"status":"published","title":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the...","description":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03589,"percentile":0.89505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-09-17T10:00:00Z","modified":"2026-06-16T23:59:20Z","products":[{"vendor":"dahuasecurity","product":"dvr0404hd-a"},{"vendor":"dahuasecurity","product":"dvr0404hd-l"},{"vendor":"dahuasecurity","product":"dvr0404hd-s"},{"vendor":"dahuasecurity","product":"dvr0404hd-u"},{"vendor":"dahuasecurity","product":"dvr0404hf-a-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-al-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-s-e"},{"vendor":"dahuasecurity","product":"dvr0404hf-u-e"},{"vendor":"dahuasecurity","product":"dvr0804"},{"vendor":"dahuasecurity","product":"dvr0804hd-l"},{"vendor":"dahuasecurity","product":"dvr0804hd-s"},{"vendor":"dahuasecurity","product":"dvr0804hf-a-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-al-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-l-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-s-e"},{"vendor":"dahuasecurity","product":"dvr0804hf-u-e"},{"vendor":"dahuasecurity","product":"dvr1604hd-l"},{"vendor":"dahuasecurity","product":"dvr1604hd-s"},{"vendor":"dahuasecurity","product":"dvr1604hf-a-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-al-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-l-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-s-e"},{"vendor":"dahuasecurity","product":"dvr1604hf-u-e"},{"vendor":"dahuasecurity","product":"dvr2104c"},{"vendor":"dahuasecurity","product":"dvr2104h"},{"vendor":"dahuasecurity","product":"dvr2104hc"},{"vendor":"dahuasecurity","product":"dvr2104he"},{"vendor":"dahuasecurity","product":"dvr2108c"},{"vendor":"dahuasecurity","product":"dvr2108h"},{"vendor":"dahuasecurity","product":"dvr2108hc"},{"vendor":"dahuasecurity","product":"dvr2108he"},{"vendor":"dahuasecurity","product":"dvr2116c"},{"vendor":"dahuasecurity","product":"dvr2116h"},{"vendor":"dahuasecurity","product":"dvr2116hc"},{"vendor":"dahuasecurity","product":"dvr2116he"},{"vendor":"dahuasecurity","product":"dvr2404hf-s"},{"vendor":"dahuasecurity","product":"dvr2404lf-al"},{"vendor":"dahuasecurity","product":"dvr2404lf-s"},{"vendor":"dahuasecurity","product":"dvr3204hf-s"},{"vendor":"dahuasecurity","product":"dvr3204lf-al"},{"vendor":"dahuasecurity","product":"dvr3204lf-s"},{"vendor":"dahuasecurity","product":"dvr3224l"},{"vendor":"dahuasecurity","product":"dvr3232l"},{"vendor":"dahuasecurity","product":"dvr5104c"},{"vendor":"dahuasecurity","product":"dvr5104h"},{"vendor":"dahuasecurity","product":"dvr5104he"},{"vendor":"dahuasecurity","product":"dvr5108c"},{"vendor":"dahuasecurity","product":"dvr5108h"},{"vendor":"dahuasecurity","product":"dvr5108he"},{"vendor":"dahuasecurity","product":"dvr5116c"},{"vendor":"dahuasecurity","product":"dvr5116h"},{"vendor":"dahuasecurity","product":"dvr5116he"},{"vendor":"dahuasecurity","product":"dvr5204a"},{"vendor":"dahuasecurity","product":"dvr5204l"},{"vendor":"dahuasecurity","product":"dvr5208a"},{"vendor":"dahuasecurity","product":"dvr5208l"},{"vendor":"dahuasecurity","product":"dvr5216a"},{"vendor":"dahuasecurity","product":"dvr5216l"},{"vendor":"dahuasecurity","product":"dvr5404"},{"vendor":"dahuasecurity","product":"dvr5408"},{"vendor":"dahuasecurity","product":"dvr5416"},{"vendor":"dahuasecurity","product":"dvr5804"},{"vendor":"dahuasecurity","product":"dvr5808"},{"vendor":"dahuasecurity","product":"dvr5816"},{"vendor":"dahuasecurity","product":"dvr6404lf-s"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/800094","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5754"},{"url":"https://github.com/advisories/GHSA-hprw-r36q-86cc"}],"sources":{"cve":[{"id":"CVE-2013-5754","description":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.","status":"published","published":"2013-09-17T10:00:00Z","modified":"2024-09-16T17:47:41.217Z","updated_at":"2026-11-02T14:34:55.098814Z"}],"euvd":[{"id":"EUVD-2013-5590","description":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.","status":"published","published":"2013-09-17T10:00:00Z","modified":"2024-09-16T17:47:41Z","updated_at":"2026-11-03T00:55:38.742114Z"}],"ghsa":[{"id":"GHSA-hprw-r36q-86cc","title":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the...","description":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.","status":"published","published":"2022-05-17T05:04:21Z","modified":"2023-01-28T05:03:03Z","updated_at":"2026-11-02T14:43:54.031093Z"}],"nvd":[{"id":"CVE-2013-5754","description":"The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.","status":"published","published":"2013-09-17T12:04:28.82Z","modified":"2026-06-16T23:59:20.817Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:35.248411Z"}]}}