Researchers have uncovered a security flaw that could be used by remote hackers to alter the timestamp of videos recorded by Dahua security cameras. This vulnerability, known as CVE-2022-30564, was discovered last year by Redinent Innovations, an India-based CCTV and IoT cybersecurity company. Both Dahua and Redinent have released advisories about the vulnerability. Redinent has rated the flaw as high severity, while Dahua has given it a 5.3 CVSS score, which is considered medium severity. According to Dahua, the vulnerability affects several types of cameras and video recorders, such as IPC, SD, NVR, and XVR products. An attacker can exploit the vulnerability by sending a specially crafted packet to the device, which will modify the system time. Redinent has stated that there are thousands of internet-exposed cameras that can be targeted directly by hackers, and exploitation from the local network is also possible. The attacker must have knowledge of an API's parameters in order to exploit the vulnerability. It is likely that this vulnerability will be used in highly targeted attacks to tamper with evidence, rather than for cybercrime operations. Dahua was informed of the issue in the fall of 2022 and has released patches for each of the affected devices. In December, Redinent also disclosed a vulnerability in Hikvision wireless bridges, which could lead to remote CCTV hacking.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 09 Feb 2023 13:39:02 +0000