CVE-2025-31702

MEDIUM

Dahua embedded products - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-31702. PoCs published by itres-labs.

AI-analyzed exploit summary This repository contains tools for analyzing CVE-2025-31702, a vulnerability in Dahua devices related to P2P auto-update mechanisms. It includes scripts for decrypting device data, generating authentication codes, and brute-forcing serial numbers.

Description

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.

Exploits (1)

nomisec WORKING POC 3 stars
by itres-labs · poc
https://github.com/itres-labs/CVE-2025-31702

This repository contains tools for analyzing CVE-2025-31702, a vulnerability in Dahua devices related to P2P auto-update mechanisms. It includes scripts for decrypting device data, generating authentication codes, and brute-forcing serial numbers.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Dahua devices with P2P/Easy4IP functionality
No auth needed
Prerequisites: Access to Dahua device data files · Knowledge of device serial numbers
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 6.8
EPSS 0.0027
EPSS Percentile 19.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-732
Status published
Products (2)
Dahua/IPC Affected products include certain models from the IPC-1XXX, IPC-2XXX, IPC-WX, and IPC-ECXX series, a
Dahua/SD Affected products include certain models from the SD3A, SD2A, SD3D, SDT2A, and SD2C series, and limi
Published Oct 15, 2025
Tracked Since Feb 18, 2026