CVE-2017-6343

Exploitation likely. EPSS gives it a 60% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.08.1High EPSS percentile99th60% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2017-02-27Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you operate a Dahua DHI-HCVR7216A-S3 with the listed NVR, camera, or SmartPSS software versions.
Ask your IT provider or Dahua vendor whether a supported replacement firmware or device is available; no fixed version is currently documented.
Restrict access to the recorder's web interface to trusted internal networks and remove any internet-facing access.
Change administrator passwords and review device login records for unfamiliar access.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117.

In plain language

Written by AI from the record

Dahua DHI-HCVR7216A-S3 devices running NVR Firmware 3.210.0001.10, Camera Firmware 2.400.0000.28.R, or SmartPSS Software 1.16.1 should be treated as at risk because someone with a known admin password code can enter remotely.

CVE-2017-6343 enables unauthenticated administrative access to the Dahua DHI-HCVR7216A-S3 web interface when an attacker knows the device-specific MD5 Admin Hash.

If you're affected

Video system takeover
Camera feed exposure
Recording access
Security operations disruption

What is it

This is a flaw in the login screen of a video recorder system. It is like a lock that can be opened with a known copy of its master-key pattern, without knowing the owner's actual key; an intruder could then control the recorder and view its contents.

Who is affected

This matters to you if you use or run a Dahua DHI-HCVR7216A-S3 video recorder with the affected software releases. It is a risk when its web interface is reachable over the network, especially from the internet; the attacker does not need an account or someone to click anything.

How urgent is it

An attacker who has the required known administrator password code can attempt to take over the device remotely. There is no confirmed public exploitation or public attack code on record, but the predicted likelihood of exploitation is high and rising, so treat this as an amber-priority remediation item.

What to do — in detail

Confirm the model and installed versions from the device administration interface or your asset records: Dahua DHI-HCVR7216A-S3 with NVR Firmware 3.210.0001.10, Camera Firmware 2.400.0000.28.R, or SmartPSS Software 1.16.1. Identify whether the web interface is exposed through internet port forwarding, a public address, remote-access rules, or a vendor cloud/remote-management setup.

No fixed firmware or software version is documented in the available findings. Contact Dahua or the maintaining integrator for a supported remediation path, which may require firmware replacement, a vendor-supplied update, or replacing unsupported equipment. Do not install unverified firmware from third parties.

Until a supported fix is available, block internet access to the web interface, allow administration only from a dedicated trusted network or VPN, and limit access to named administrator workstations. Change administrator credentials after restricting exposure, then review login and configuration records for unknown administrator sessions, new accounts, altered network settings, or unexpected recording access.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor vendor advisories for a supported fix and monitor device access logs and network connections for unexpected remote administration activity.

Technical context

CVSS v3.0 is 8.1 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-287, improper authentication: knowledge of the MD5 Admin Hash permits remote administrative login to the web interface without the corresponding password. The network attack requires no privileges or user interaction and is reachable in the default configuration, but knowledge of the specific hash is a precondition. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS predicts a 60.3% likelihood (99th percentile) and the trend is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

60% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

23 events over 3495 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

dahuasecuritycommercial · CNaka dahua security

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable