{"id":"CVE-2013-6117","aliases":["EUVD-2013-5946","GHSA-f492-fgmp-2462"],"status":"published","title":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and...","description":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.70162,"percentile":0.99385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2014-07-11T19:00:00Z","modified":"2026-06-16T23:59:59Z","exploits":[{"source":"exploitdb","id":"EDB-29673","title":"Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)","type":"webapps","platform":"hardware","date":"2013-11-18","url":"https://www.exploit-db.com/exploits/29673"},{"source":"metasploit","id":"auxiliary/scanner/misc/dahua_dvr_auth_bypass","title":"Dahua DVR Auth Bypass Scanner","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass"},{"source":"pocgithub","id":"fsn4k3/dahua-dvr-metasploit","title":"fsn4k3/dahua-dvr-metasploit","date":"2026-06-04","url":"https://github.com/fsn4k3/dahua-dvr-metasploit"},{"source":"pocgithub","id":"milo2012/CVE-2013-6117","title":"milo2012/CVE-2013-6117","date":"2018-07-23","url":"https://github.com/milo2012/CVE-2013-6117"}],"products":[{"vendor":"dahuasecurity","product":"dvr_firmware"}],"references":[{"url":"http://seclists.org/bugtraq/2013/Nov/62","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.osvdb.org/99783","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://packetstormsecurity.com/files/124022/Dahua-DVR-Authentication-Bypass.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.exploit-db.com/exploits/29673","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://blog.depthsecurity.com/2013/11/dahua-dvr-authentication-bypass-cve.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6117"},{"url":"https://github.com/advisories/GHSA-f492-fgmp-2462"}],"sources":{"cve":[{"id":"CVE-2013-6117","description":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.","status":"published","published":"2014-07-11T19:00:00Z","modified":"2024-08-06T17:29:42.982Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-5946","description":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.","status":"published","published":"2014-07-11T19:00:00Z","modified":"2024-08-06T17:29:42Z","updated_at":"2026-11-03T01:56:27.166265Z"}],"ghsa":[{"id":"GHSA-f492-fgmp-2462","title":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and...","description":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.","status":"published","published":"2022-05-17T04:40:08Z","modified":"2023-01-28T05:02:14Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:43:44.460546Z"}],"nvd":[{"id":"CVE-2013-6117","description":"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.","status":"published","published":"2014-07-11T19:55:02.673Z","modified":"2026-06-16T23:59:59.393Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:51.408338Z"}]}}