{
  "Name": "Amcrest/Dahua Unauthenticated-Audio-Streaming (CVE-2019-3948)",
  "Description": "The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.",
  "Product": "amcrest_camera",
  "Homepage": "https://amcrest.com/",
  "DisclosureDate": "2019-07-29",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"amcrest_camera\" || app=\"大华-视频监控\" || app=\"AMCREST-camera\" || app=\"dahua-视频监控\"",
  "GobyQuery": "app=\"amcrest_camera\" || app=\"大华-视频监控\" || app=\"AMCREST-camera\" || app=\"dahua-视频监控\"",
  "Level": "2",
  "Impact": "An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.",
  "Recommendation": "Download patch file from https://www.dahuasecurity.com/support/cybersecurity/details/627",
  "References": [
    "http://packetstormsecurity.com/files/153813/Amcrest-Cameras-2.520.AC00.18.R-Unauthenticated-Audio-Streaming.html",
    "https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02.pdf",
    "https://www.dahuasecurity.com/support/cybersecurity/details/627?us",
    "https://www.tenable.com/security/research/tra-2019-36",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-3948",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3948"
  ],
  "HasExp": false,
  "ExpParams": null,
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
		"AND",
		{
			  "Request": {
					"method": "GET",
					"uri": "/videotalk",
					"follow_redirect": false,
					"header": {},
					"data_type": "text",
					"data": ""
			  },
			  "ResponseTest": {
					"type": "group",
					"operation": "AND",
					"checks": [
						  {
								"type": "item",
								"variable": "$code",
								"operation": "==",
								"value": "200",
								"bz": ""
						  },
						  {
								"type": "item",
								"variable": "$head",
								"operation": "contains",
								"value": "Audio/DHAV",
								"bz": ""
						  }
					]
			  },
			  "SetVariable": []
		}
  ],
  "ExploitSteps": null,
  "Tags": ["iot", "dvr", "surveillance"],
  "CVEIDs": [
    "CVE-2019-3948"
  ],
  "CVSSScore": "7.5",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}