CVE-2019-3948
Quick assessment
Affected
n/a Dahua IPC-XXBXX
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Amcrest IP2M-841B是Amcrest公司的一款IP摄像机。 使用2.520.AC00.18.R版本固件的Amcrest IP2M-841B中存在授权问题漏洞，该漏洞在访问HTTP端点/视频通话时，程序没有要求进行身份验证。远程攻击者可利用该漏洞连接到该端点并监听摄像头所录制的音频。
Public Exploits 1
ExploitDB · 1
EDB-47188 [webapps]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-3948
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Amcrest IP2M-841B 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Amcrest IP2M-841B是Amcrest公司的一款IP摄像机。 使用2.520.AC00.18.R版本固件的Amcrest IP2M-841B中存在授权问题漏洞，该漏洞在访问HTTP端点/视频通话时，程序没有要求进行身份验证。远程攻击者可利用该漏洞连接到该端点并监听摄像头所录制的音频。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Dahua IPC-XXBXX | V2.622.0000000.9.R | - |
|
| - | Dahua IPC HX5X3X and HX4X3X | V2.800.0000008.0.R | - |
|
| - | Dahua DH-IPC HX883X and DH-IPC-HX863X | V2.622.0000000.7.R | - |
|
| - | Dahua DH-SD4XXXXX | V2.623.0000000.7.R | - |
|
| - | Dahua DH-SD5XXXXX | V2.623.0000000.1.R | - |
|
| - | Dahua DH-SD6XXXXX | V2.640.0000000.2.R and V2.623.0000000.1.R | - |
|
| - | Dahua NVR5XX-4KS2 | V3.216.0000006.0.R | - |
|
| - | Dahua NVR4XXX-4KS2 | V3.216.0000006.0.R and NVR2XXX-4KS2 | - |
|
II. Public POCs for CVE-2019-3948
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-3948
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-3948 (1)
Exploits & Public PoCs for CVE-2019-3948 (1)
Other References for CVE-2019-3948 (2)
-
https://www.dahuasecurity.com/support/cybersecurity/details/627?us x_refsource_MISC
Same Patch Batch · n/a · 2019-07-29 · 33 CVEs total
| CVE-2019-13498 | One Identity Cloud Access Manager 安全特征问题漏洞 | |
| CVE-2018-18570 | Planon 跨站脚本漏洞 | |
| CVE-2019-14431 | INSIDE Secure MatrixSSL 缓冲区错误漏洞 | |
| CVE-2019-14418 | Veritas Technologies Resiliency Platform 路径遍历漏洞 | |
| CVE-2019-14417 | Veritas Technologies Resiliency Platform 输入验证错误漏洞 | |
| CVE-2019-14416 | Veritas Technologies Resiliency Platform 输入验证错误漏洞 | |
| CVE-2019-14415 | Veritas Technologies Resiliency Platform 跨站脚本漏洞 | |
| CVE-2019-13655 | Imgix 资源管理错误漏洞 | |
| CVE-2018-17213 | PrinterOn Central Print Services 授权问题漏洞 | |
| CVE-2018-17211 | PrinterOn Central Print Services 信息泄露漏洞 | |
| CVE-2019-13571 | WordPress Advanced CF7 DB SQL注入漏洞 | |
| CVE-2019-14271 | Docker 代码注入漏洞 | |
| CVE-2019-11868 | SoftEther VPN See.sys 缓冲区错误漏洞 | |
| CVE-2016-10766 | Open edX platform 跨站请求伪造漏洞 | |
| CVE-2016-10765 | Open edX platform 输入验证错误漏洞 | |
| CVE-2019-13126 | NATS Server 输入验证错误漏洞 | |
| CVE-2019-14378 | libslirp 缓冲区错误漏洞 | |
| CVE-2015-5601 | Open edX platform 代码问题漏洞 | |
| CVE-2019-11201 | Dolibarr ERP/CRM 代码注入漏洞 | |
| CVE-2019-11200 | Dolibarr ERP/CRM 输入验证错误漏洞 |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-108770
Appwrite Browser Screenshot Service Get.php PublicHostname s -
CVE-2026-108572
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-si -
CVE-2026-108539
GPAC MP4Box filter_queue.c gf_fq_pop use after free -
CVE-2026-108538
GPAC MP4Box os_thread.c gf_mx_v use after free -
CVE-2026-79363
Cloudron 9.1.7/9.2 品牌页脚存储型XSS漏洞
V. Comments for CVE-2019-3948
No comments yet