CVE-2013-6117: Dahua DVR authentication bypass on TCP port 37777

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote access to credentials and administrative functions on an internet-reachable device, with public exploit code and very high EPSS, warrants high priority despite no KEV listing.

What it is

Dahua DVR firmware versions 2.608.0000.0 and 2.608.GV00.0 contain an improper authentication flaw (CWE-287) reachable over TCP port 37777. An unauthenticated remote attacker can bypass authentication and then read sensitive data, including user credentials, change user passwords, and clear log files. Because the device holds credentials and audit records, the flaw undermines both confidentiality and integrity of the DVR.

Impact

An attacker gains unauthenticated access to DVR functions: disclosure of user credentials, password changes, log deletion, and other administrative actions. This can lead to full device takeover and loss of audit evidence.

Attack surface

Reachable over the network via a request to TCP port 37777; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. No affected version detail beyond the two listed firmware builds is provided.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.69676 (99.3rd percentile) and public references include an Exploit-DB entry and Packet Storm advisory, indicating public exploit material exists.

What to do

• Apply the vendor fix or upgrade DVR firmware to a version later than 2.608.0000.0 and 2.608.GV00.0; confirm availability with Dahua since the record does not name a patched build.
• Block or restrict TCP port 37777 to trusted management hosts and never expose DVRs directly to the internet.
• Place DVRs behind a VPN or management VLAN with firewall rules limiting access to authorized administrators.
• Rotate all DVR user credentials and review accounts after any suspected exposure, since credentials can be read through this flaw.
• Preserve and back up logs off-device, because the flaw allows attackers to clear log files.

Detection

• Monitor network flows and firewall logs for inbound connections to TCP port 37777 from untrusted or external sources.
• Alert on DVR authentication and configuration events, especially password changes and log-clearing actions, and correlate with source IPs.
• Hunt for unexpected outbound traffic from DVR segments that could indicate post-compromise access or data exfiltration.
• Review DVR logs for gaps or resets that may indicate cleared audit records.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.