CVE-2013-5754
Dahua
- Published
- 17 September 2013
- Last modified
- 16 June 2026
- CVSS
- 10.0 v2.0
- Severity
- high
- EPSS
- 3.6% (89th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- CWE-264
AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving (1) ActiveX, (2) a standalone client, or (3) unspecified other vectors, a different vulnerability than CVE-2013-3612.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 3.6% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| DVR0404HD-A | Dahua | unknown | — |
| DVR0404HD-L | Dahua | unknown | — |
| DVR0404HD-S | Dahua | unknown | — |
| DVR0404HD-U | Dahua | unknown | — |
| DVR0404HF-A-E | Dahua | unknown | — |
| DVR0404HF-AL-E | Dahua | unknown | — |
| DVR0404HF-S-E | Dahua | unknown | — |
| DVR0404HF-U-E | Dahua | unknown | — |
| DVR0804 | Dahua | unknown | — |
| DVR0804HD-L | Dahua | unknown | — |
| DVR0804HD-S | Dahua | unknown | — |
| DVR0804HF-A-E | Dahua | unknown | — |
| DVR0804HF-AL-E | Dahua | unknown | — |
| DVR0804HF-L-E | Dahua | unknown | — |
| DVR0804HF-S-E | Dahua | unknown | — |
| DVR0804HF-U-E | Dahua | unknown | — |
| DVR1604HD-L | Dahua | unknown | — |
| DVR1604HD-S | Dahua | unknown | — |
| DVR1604HF-A-E | Dahua | unknown | — |
| DVR1604HF-AL-E | Dahua | unknown | — |
| DVR1604HF-L-E | Dahua | unknown | — |
| DVR1604HF-S-E | Dahua | unknown | — |
| DVR1604HF-U-E | Dahua | unknown | — |
| DVR2104C | Dahua | unknown | — |
| DVR2104H | Dahua | unknown | — |
| DVR2104HC | Dahua | unknown | — |
| DVR2104HE | Dahua | unknown | — |
| DVR2108C | Dahua | unknown | — |
| DVR2108H | Dahua | unknown | — |
| DVR2108HC | Dahua | unknown | — |
| DVR2108HE | Dahua | unknown | — |
| DVR2116C | Dahua | unknown | — |
| DVR2116H | Dahua | unknown | — |
| DVR2116HC | Dahua | unknown | — |
| DVR2116HE | Dahua | unknown | — |
| DVR2404HF-S | Dahua | unknown | — |
| DVR2404LF-AL | Dahua | unknown | — |
| DVR2404LF-S | Dahua | unknown | — |
| DVR3204HF-S | Dahua | unknown | — |
| DVR3204LF-AL | Dahua | unknown | — |
| DVR3204LF-S | Dahua | unknown | — |
| DVR3224L | Dahua | unknown | — |
| DVR3232L | Dahua | unknown | — |
| DVR5104C | Dahua | unknown | — |
| DVR5104H | Dahua | unknown | — |
| DVR5104HE | Dahua | unknown | — |
| DVR5108C | Dahua | unknown | — |
| DVR5108H | Dahua | unknown | — |
| DVR5108HE | Dahua | unknown | — |
| DVR5116C | Dahua | unknown | — |
| DVR5116H | Dahua | unknown | — |
| DVR5116HE | Dahua | unknown | — |
| DVR5204A | Dahua | unknown | — |
| DVR5204L | Dahua | unknown | — |
| DVR5208A | Dahua | unknown | — |
| DVR5208L | Dahua | unknown | — |
| DVR5216A | Dahua | unknown | — |
| DVR5216L | Dahua | unknown | — |
| DVR5404 | Dahua | unknown | — |
| DVR5408 | Dahua | unknown | — |
| DVR5416 | Dahua | unknown | — |
| DVR5804 | Dahua | unknown | — |
| DVR5808 | Dahua | unknown | — |
| DVR5816 | Dahua | unknown | — |
| DVR6404LF-S | Dahua | unknown | — |
References
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.