Dahua Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Dahua products.

Products

Showing 24 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Unauthenticated Remote Denial of Service

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.

CWE-617Jun 10, 2026
CVSS8.7v4.0EPSS0.395%PoCs1SignalsSTIX

Dahua IPC/SD Authenticated Remote Denial of Service

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.

CWE-617Jun 10, 2026
CVSS6.9v4.0EPSS0.362%PoCs1SignalsSTIX

Dahua IPC CA Root Certificate Exposure

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and undermine the certificate trust chain.

CWE-538Jun 10, 2026
CVSS2.3v4.0EPSS0.19%PoCs1SignalsSTIX

Dahua NVR/XVR Serial Port Authentication Bypass and Privilege Escalation

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges.

CWE-305Mar 18, 2026
CVSS2.4v4.0EPSS0.231%PoCs0SignalsSTIX

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.

CWE-732Oct 15, 2025
CVSS6.8v3.1EPSS0.282%PoCs1SignalsSTIX

Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload

A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability…

CWE-22CWE-434Aug 27, 2025
CVSS10.0v4.0EPSS0.813%PoCs0SignalsSTIX

Dahua EIMS capture_handle.action RCE

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was fir…

CWE-78Aug 27, 20251 related artifact
CVSS10.0v4.0EPSS7.52%PoCs1SignalsSTIX

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.

CWE-120Jul 23, 2025
CVSS8.1v3.1EPSS0.794%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.

CWE-120Jul 23, 2025
CVSS8.1v3.1EPSS0.828%PoCs1SignalsSTIX

Dahua Smart Cloud Gateway Registration Management Platform SQL Injection

An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

CWE-200CWE-89Jul 1, 2025
CVSS8.7v4.0EPSS0.425%PoCs0SignalsSTIX

Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal

A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CWE-23CWE-24Jan 5, 2025
CVSS5.3v4.0EPSS0.578%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.

CWE-121CWE-20Jul 31, 2024
CVSS8.6v3.1EPSS0.492%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.

CWE-20CWE-617Jul 31, 2024
CVSS7.5v3.1EPSS0.56%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.

CWE-20CWE-476Jul 31, 2024
CVSS7.5v3.1EPSS0.56%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.

Jul 31, 2024
CVSS6.5v3.1EPSS0.458%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.

Jul 31, 2024
CVSS6.0v3.1EPSS0.437%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products.  After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.

CWE-703Jul 31, 2024
CVSS4.9v3.1EPSS0.458%PoCs0SignalsSTIX

A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.

CWE-20CWE-770Jul 31, 2024
CVSS7.5v3.1EPSS0.56%PoCs0SignalsSTIX

Dahua Smart Park Management unrestricted upload

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not res…

CWE-434Jul 22, 20231 related artifact
CVSS6.3v3.1EPSS73.7%PoCs1SignalsSTIX

Dahua Smart Parking Management image server-side request forgery

A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE-918Jun 6, 2023
CVSS3.5v3.1EPSS0.461%PoCs0SignalsSTIX

Dahua IP Camera Authentication Bypass Vulnerability

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

CWE-287Sep 15, 20211 related artifact
CVSS9.8v3.1EPSS99.6%PoCs3SignalsSTIX

Dahua IP Camera Authentication Bypass Vulnerability

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

CWE-287Sep 15, 20211 related artifact
CVSS9.8v3.1EPSS99.9%PoCs10SignalsSTIX

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.

CWE-311Sep 17, 2019
CVSS5.3v3.1EPSS0.784%PoCs0SignalsSTIX

Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow

Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow. Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely. Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length …

CWE-119CWE-121Jul 24, 2018
CVSS9.8v3.0EPSS5.29%PoCs0SignalsSTIX