{"id":3514,"date":"2022-07-29T17:06:01","date_gmt":"2022-07-29T16:06:01","guid":{"rendered":"https:\/\/sajberinfo.com\/2022\/11\/21\/text-55\/"},"modified":"2022-12-04T11:10:16","modified_gmt":"2022-12-04T10:10:16","slug":"onvif-ranjivost-u-dahua-ip-kamerama","status":"publish","type":"post","link":"https:\/\/sajberinfo.com\/en\/2022\/07\/29\/onvif-ranjivost-u-dahua-ip-kamerama\/","title":{"rendered":"ONVIF ranjivost u Dahua IP kamerama"},"content":{"rendered":"

<\/p>\n

Otkrivena je ranjivost u Dahua IP<\/em> kamerama, konkretno u ONVIF<\/em> (Open Network Video Interface Forum<\/em>) standardu, koja omogu\u0107ava preuzimanje kontrole nad ure\u0111ajima. <\/span><\/span><\/p>\n

\"ptz

Image by Photo Mix<\/em><\/a> from Pixabay<\/em><\/a><\/p><\/div>\n

Ozna\u010dena kao CVE-2022-30563<\/em> (sa CVSS<\/em> ocjenom: 7.4), omogu\u0107ava napada\u010dima da zloupotrebe mre\u017ene kamere preko prethodno ne \u0161ifrirane ONVIF<\/em> komunikacije i ponovo reprodukuju korisni\u010dke podatke za prijavu prema ure\u0111aju, prema izvje\u0161taju<\/a> sigurnosne kompanije Nozomi Networks<\/em>.<\/i><\/span><\/span><\/p>\n

Kompanija Dahua<\/em> je objavila<\/a> da ima spremna sigurnosna a\u017euriranja od 28. juna 2022. godine, koja se odnose\u00a0 na sljede\u0107e proizvode: <\/span><\/span>\u00a0<\/span><\/span><\/p>\n

– Dahua ASI7XXX<\/em>: na sve verzije prije v1.000.0000009.0.R.220620<\/em><\/span><\/span><\/p>\n

– Dahua IPC-HDBW2XXX<\/em>: na sve verzije prije v2.820.0000000.48.R.220614<\/em><\/span><\/span><\/p>\n

– Dahua IPC-HX2XXX<\/em>: na sve verzije prije v2.820.0000000.48.R.220614<\/em><\/span><\/span>\u00a0<\/span><\/span><\/em><\/p>\n

Ranjivost koja je identifikovana od strane\u00a0 sigurnosne kompanije Nozomi Networks<\/em> se odnosi na mehanizam za prijavljivanje pod nazivom \u201cWS-UsernameToken<\/a><\/em>\u201d implementiranom u odre\u0111enom broju IP<\/em> kamera proizvo\u0111a\u010da Dahua<\/em>. Ranjivost omogu\u0107ava napada\u010du da doda novi administratorski nalog, omogu\u0107avaju\u0107i mu najve\u0107i stepen pristupa ure\u0111aju, \u0161to uklju\u010duje i gledanje prenosa sa kamere u\u017eivo. Napada\u010du je samo potrebno da \u201cuhvati<\/em>\u201d ne \u0161ifrovani mre\u017eni zahtev autentifikovan pomo\u0107u \u0161eme WS-UsernameToken<\/em>-a, koji poslije izmijenjen \u0161alje ure\u0111aju kako bi ga prevario i dobio mogu\u0107nost da napravi administratorski nalog.<\/span><\/span><\/p>\n

Otkrivanje ove ranjivosti u Dahua IP<\/em> kamerama je posljedica otkrivenih sli\u010dnih ranjivosti u ure\u0111ajima proizvo\u0111a\u010da Reolink<\/a>, ThroughTek<\/a>, Annke<\/a><\/em>\u00a0i Axis<\/a><\/em>, \u0161to upozorava na potencijalnu opasnost, s obzirom da se ovi ure\u0111aju postavljaju na sigurnosno kriti\u010dnim mjestima. <\/span><\/span><\/p>\n

Kompanija Dahua<\/em> savjetuje svojim korisnicima, u skladu sa najboljim praksama u sajber bezbjednosti, izvr\u0161e preuzimanje i primjene potrebna a\u017euriranja sa njihove stranice za podr\u0161ku<\/a> ili da kontaktiraju lokalnu Dahua<\/em>\u00a0 podr\u0161ku. <\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Otkrivena je ranjivost u Dahua IP kamerama, konkretno u ONVIF (Open Network Video Interface Forum) standardu, koja omogu\u0107ava preuzimanje kontrole nad ure\u0111ajima. Ozna\u010dena kao CVE-2022-30563 (sa CVSS ocjenom: 7.4), omogu\u0107ava napada\u010dima da zloupotrebe mre\u017ene...<\/p>","protected":false},"author":1,"featured_media":3864,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[127,225,64,126],"class_list":["post-3514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hronike","tag-dahua","tag-onvif","tag-sajber-prijetnja","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/3514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/comments?post=3514"}],"version-history":[{"count":0,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/3514\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media\/3864"}],"wp:attachment":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media?parent=3514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/categories?post=3514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/tags?post=3514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}