https://vulnogram.org/ Most recent CVEs assigned by Dahua Technologies (dahua). https://vulnogram.org/seaview/icons/dahua.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-29116 https://vulnogram.org/CVE-2026-29116 A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service. High Network Exploitable Wed, 10 Jun 2026 06:16:34 GMT https://vulnogram.org/CVE-2026-29115 https://vulnogram.org/CVE-2026-29115 A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service. Medium Wed, 10 Jun 2026 06:08:21 GMT https://vulnogram.org/CVE-2026-29114 https://vulnogram.org/CVE-2026-29114 A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and under… Low Network Exploitable Wed, 10 Jun 2026 05:44:50 GMT https://vulnogram.org/CVE-2025-31703 https://vulnogram.org/CVE-2025-31703 A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges. Low Wed, 18 Mar 2026 07:13:21 GMT https://vulnogram.org/CVE-2025-31702 https://vulnogram.org/CVE-2025-31702 A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive… Medium Wed, 15 Oct 2025 05:53:35 GMT https://vulnogram.org/CVE-2025-31701 https://vulnogram.org/CVE-2025-31701 A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devi… High Network Exploitable Wed, 23 Jul 2025 06:55:20 GMT https://vulnogram.org/CVE-2025-31700 https://vulnogram.org/CVE-2025-31700 A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devi… High Network Exploitable Wed, 23 Jul 2025 06:54:37 GMT https://vulnogram.org/CVE-2024-39950 https://vulnogram.org/CVE-2024-39950 A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization. High Network Exploitable Wed, 31 Jul 2024 03:45:12 GMT https://vulnogram.org/CVE-2024-39949 https://vulnogram.org/CVE-2024-39949 A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. High Network Exploitable Wed, 31 Jul 2024 03:42:39 GMT https://vulnogram.org/CVE-2024-39948 https://vulnogram.org/CVE-2024-39948 A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. High Network Exploitable Wed, 31 Jul 2024 03:40:29 GMT https://vulnogram.org/CVE-2024-39947 https://vulnogram.org/CVE-2024-39947 A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. Medium Wed, 31 Jul 2024 03:22:09 GMT https://vulnogram.org/CVE-2024-39946 https://vulnogram.org/CVE-2024-39946 A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization. Medium Wed, 31 Jul 2024 03:20:01 GMT https://vulnogram.org/CVE-2024-39945 https://vulnogram.org/CVE-2024-39945 A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. Medium Wed, 31 Jul 2024 03:16:31 GMT https://vulnogram.org/CVE-2024-39944 https://vulnogram.org/CVE-2024-39944 A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. High Network Exploitable Wed, 31 Jul 2024 03:13:03 GMT https://vulnogram.org/CVE-2022-30564 https://vulnogram.org/CVE-2022-30564 Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time. Medium Network Exploitable Thu, 09 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-45434 https://vulnogram.org/CVE-2022-45434 Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker co… Medium Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45433 https://vulnogram.org/CVE-2022-45433 Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could get t… Low Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45432 https://vulnogram.org/CVE-2022-45432 Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated search fo… Medium Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45431 https://vulnogram.org/CVE-2022-45431 Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated… High Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45430 https://vulnogram.org/CVE-2022-45430 Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could enable or dis… Low Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45429 https://vulnogram.org/CVE-2022-45429 Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules. High Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45428 https://vulnogram.org/CVE-2022-45428 Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can obtain the debugging information. Low Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45427 https://vulnogram.org/CVE-2022-45427 Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files. High Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45426 https://vulnogram.org/CVE-2022-45426 Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files. Medium Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45425 https://vulnogram.org/CVE-2022-45425 Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability. High Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45424 https://vulnogram.org/CVE-2022-45424 Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface. Medium Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45423 https://vulnogram.org/CVE-2022-45423 Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly e… High Network Exploitable Tue, 27 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-30563 https://vulnogram.org/CVE-2022-30563 When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying the user's login packet. Tue, 28 Jun 2022 13:44:56 GMT https://vulnogram.org/CVE-2022-30562 https://vulnogram.org/CVE-2022-30562 If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attac… Tue, 28 Jun 2022 13:43:54 GMT https://vulnogram.org/CVE-2022-30561 https://vulnogram.org/CVE-2022-30561 When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the user's login packet. Tue, 28 Jun 2022 13:42:37 GMT https://vulnogram.org/CVE-2022-30560 https://vulnogram.org/CVE-2022-30560 When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash. Tue, 28 Jun 2022 13:41:11 GMT https://vulnogram.org/CVE-2021-33046 https://vulnogram.org/CVE-2021-33046 Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords. Thu, 13 Jan 2022 20:27:13 GMT https://vulnogram.org/CVE-2021-33045 https://vulnogram.org/CVE-2021-33045 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. Critical Known Exploited Network Exploitable Wed, 15 Sep 2021 21:50:08 GMT https://vulnogram.org/CVE-2021-33044 https://vulnogram.org/CVE-2021-33044 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. Critical Known Exploited Network Exploitable Wed, 15 Sep 2021 21:36:04 GMT https://vulnogram.org/CVE-2020-9502 https://vulnogram.org/CVE-2020-9502 Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device. Wed, 13 May 2020 15:21:12 GMT https://vulnogram.org/CVE-2020-9501 https://vulnogram.org/CVE-2020-9501 Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client… Wed, 13 May 2020 15:17:20 GMT https://vulnogram.org/CVE-2019-9682 https://vulnogram.org/CVE-2019-9682 Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user u… Wed, 13 May 2020 15:10:43 GMT https://vulnogram.org/CVE-2020-9500 https://vulnogram.org/CVE-2020-9500 Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down. Thu, 09 Apr 2020 13:21:01 GMT https://vulnogram.org/CVE-2020-9499 https://vulnogram.org/CVE-2020-9499 Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down. Thu, 09 Apr 2020 13:19:23 GMT https://vulnogram.org/CVE-2019-9677 https://vulnogram.org/CVE-2019-9677 The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,I… Wed, 18 Sep 2019 18:46:29 GMT https://vulnogram.org/CVE-2019-9678 https://vulnogram.org/CVE-2019-9678 Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-… Wed, 18 Sep 2019 18:42:45 GMT https://vulnogram.org/CVE-2019-9680 https://vulnogram.org/CVE-2019-9680 Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious data packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC… Wed, 18 Sep 2019 18:36:13 GMT https://vulnogram.org/CVE-2019-9679 https://vulnogram.org/CVE-2019-9679 Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-H… Wed, 18 Sep 2019 18:32:15 GMT https://vulnogram.org/CVE-2019-9681 https://vulnogram.org/CVE-2019-9681 Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2… Tue, 17 Sep 2019 16:02:18 GMT https://vulnogram.org/CVE-2019-9676 https://vulnogram.org/CVE-2019-9676 Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used b… Wed, 12 Jun 2019 14:12:03 GMT https://vulnogram.org/CVE-2017-9317 https://vulnogram.org/CVE-2017-9317 Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device. Wed, 23 May 2018 15:00:00 GMT https://vulnogram.org/CVE-2017-9315 https://vulnogram.org/CVE-2017-9315 Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being… Tue, 28 Nov 2017 19:00:00 GMT https://vulnogram.org/CVE-2017-9316 https://vulnogram.org/CVE-2017-9316 Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during p… Mon, 27 Nov 2017 17:00:00 GMT https://vulnogram.org/CVE-2017-9314 https://vulnogram.org/CVE-2017-9314 Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of fo… Mon, 13 Nov 2017 16:00:00 GMT