{"id":"CVE-2017-9317","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-9317","generatedAt":"2026-10-28T19:04:15.528Z","title":"Privilege escalation vulnerability found in some Dahua IP devices.","description":"Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device.","published":"2018-05-23T15:29:00.000Z","lastModified":"2026-06-17T01:27:53.000Z","status":"Modified","sourceIdentifier":"cybersecurity@dahuatech.com","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":[],"affected":["dahuasecurity/xvr5x16 firmware","dahuasecurity/xvr5x08 firmware","dahuasecurity/xvr5x04 firmware","dahuasecurity/xvr7x16 firmware","dahuasecurity/ipc-hdbw4xxx firmware","dahuasecurity/ipc-hdbw5xxx firmware"],"epss":{"score":0.00962,"percentile":0.61464,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.dahuasecurity.com/support/cybersecurity/annoucementNotice/337","tags":["Patch","Vendor Advisory"],"source":"cybersecurity@dahuatech.com"},{"url":"https://www.dahuasecurity.com/support/cybersecurity/annoucementNotice/337","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-9317","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}