CVE-2025-31700

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-31700 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC.

Description

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

IPC

Browse Dahua / IPC

Default status: unaffected

CVE ListAffected products include certain models from the IPC-1XXX, IPC-2XXX, IPC-WX, and IPC-ECXX series, and limited to versions which build time before April 16, 2025.affected

SD

Browse Dahua / SD

Default status: unaffected

CVE ListAffected products include certain models from the SD3A, SD2A, SD3D, SDT2A, and SD2C series, and limited to versions which build time before April 16, 2025.affected

Proofs of concept

1

Repository PoCs

GitHubumair-aziz025/dahua-cve-researchRepository PoCby umair-aziz02522Scanner8 files

55.6 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a collection of Python scripts that probe Dahua IP cameras for known vulnerabilities (CVE-2021-33044, CVE-2021-33045, CVE-2025-31700, CVE-2025-31701). The scripts send crafted requests and oversized payloads to detect authentication bypass and buffer overflow conditions, reporting whether the target appears vulnerable. They do not perform post-exploitation actions such as executing commands or exfiltrating data.

Backdoor review

No backdoor observed in reviewed code

The reviewed Python scripts implement proof-of-concept exploits for known Dahua IP camera CVEs (CVE-2021-33044, CVE-2021-33045, CVE-2025-31700, CVE-2025-31701). The code performs authentication bypass attempts and buffer overflow probes against a user-supplied target. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential exfiltration, or deceptive payloads were observed. The scripts' actions are consistent with their stated purpose of vulnerability testing.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareDahua IP Camera firmware
Attack typesauthentication bypassbuffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The scripts' primary operation is to check for the presence of vulnerabilities by sending specific requests and interpreting responses. They do not contain code to execute commands, establish shells, or perform any post-authentication actions. The README describes them as 'scanner' and 'probe' tools, and the code itself only tests conditions and reports results.

README.md:77-80dahua_exploit.py:99-124dahua_exploit.py:212-239

Requirements

  • Network access to the target Dahua device's HTTP service (default port 80) and optionally TCP port 37777.dahua_exploit.py:46-48dahua_exploit.py:296-298

Observed behavior

  • Sends an RPC2 login request with an empty-password hash to test for authentication bypass (CVE-2021-33044/45).dahua_exploit.py:99-124
  • Sends an oversized JSON payload to the HTTP RPC2 endpoint to probe for a buffer overflow (CVE-2025-31700).dahua_exploit.py:153-181
  • Sends an oversized binary frame to TCP port 37777 to probe for a buffer overflow (CVE-2025-31701).dahua_exploit.py:184-209
  • Reports whether the target is vulnerable based on response codes, connection resets, or timeouts.dahua_exploit.py:269-278
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
HTTP POST to /RPC2_Login on user-supplied target and portThe scripts send crafted authentication and overflow payloads to the target device's RPC2 login endpoint, which is the expected behavior for testing the described CVEs.dahua_exploit.py:46-55dahua_exploit.py:99-124dahua_rce.py:60-101
Network Connection
TCP connection to user-supplied target on port 37777The scripts send an oversized binary frame to the Dahua DVRIP protocol port to test for buffer overflow vulnerabilities, as described in the CVE details.dahua_exploit.py:184-209dahua_rce.py:128-169
Cryptographic Operation
MD5 hashing of user:realm: and user:realm:password stringsThe scripts compute MD5 hashes to construct authentication bypass and default credential login attempts, which is the documented mechanism for CVE-2021-33044/45.dahua_exploit.py:81-92
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false; 5 of 8 files in the repository were omitted from the text evidence. The omitted files may contain additional scripts (e.g., dahua_auth_bypass.py, dahua_scanner.py) that could alter the classification.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its behavior against a live target is not verified.
  • 5 text files in the repository were omitted from the evidence packet and were not reviewed.
  • The analysis is limited to static review of the provided source code; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2