Dahua products
by Dahua
CVEs (22)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-33045 | Cri | 0.84 | 9.8 | 1.00 | KEV | Sep 15, 2021 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. | |
| CVE-2021-33044 | Cri | 0.84 | 9.8 | 1.00 | KEV | Sep 15, 2021 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. | |
| CVE-2021-33046 | Cri | 0.64 | 9.8 | 0.01 | Jan 13, 2022 | Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords. | ||
| CVE-2020-9502 | Cri | 0.64 | 9.8 | 0.02 | May 13, 2020 | Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device. | ||
| CVE-2026-29116 | Hig | 0.57 | — | 0.00 | Jun 10, 2026 | A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service. | ||
| CVE-2024-39950 | Hig | 0.56 | 8.6 | 0.00 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization. | ||
| CVE-2025-31701 | Hig | 0.53 | 8.1 | 0.01 | Jul 23, 2025 | A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed… | ||
| CVE-2025-31700 | Hig | 0.53 | 8.1 | 0.01 | Jul 23, 2025 | A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed… | ||
| CVE-2024-39949 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2024-39948 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2024-39944 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2022-45429 | Hig | 0.49 | 7.5 | 0.01 | Dec 27, 2022 | Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules. | ||
| CVE-2022-45425 | Hig | 0.49 | 7.5 | 0.01 | Dec 27, 2022 | Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability. | ||
| CVE-2022-45423 | Hig | 0.49 | 7.5 | 0.01 | Dec 27, 2022 | Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). | ||
| CVE-2020-9499 | Hig | 0.47 | 7.2 | 0.01 | Apr 9, 2020 | Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down. | ||
| CVE-2024-39947 | Med | 0.42 | 6.5 | 0.00 | Jul 31, 2024 | A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2022-45426 | Med | 0.42 | 6.5 | 0.01 | Dec 27, 2022 | Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files. | ||
| CVE-2024-39946 | Med | 0.39 | 6.0 | 0.00 | Jul 31, 2024 | A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization. | ||
| CVE-2022-45424 | Med | 0.35 | 5.3 | 0.01 | Dec 27, 2022 | Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface. | ||
| CVE-2024-39945 | Med | 0.32 | 4.9 | 0.00 | Jul 31, 2024 | A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. |
- risk 0.84cvss 9.8epss 1.00
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- risk 0.84cvss 9.8epss 1.00
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- risk 0.64cvss 9.8epss 0.01
Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.
- risk 0.64cvss 9.8epss 0.02
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
- risk 0.57cvss —epss 0.00
A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.
- risk 0.56cvss 8.6epss 0.00
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
- risk 0.53cvss 8.1epss 0.01
A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed…
- risk 0.53cvss 8.1epss 0.01
A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed…
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.49cvss 7.5epss 0.01
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
- risk 0.49cvss 7.5epss 0.01
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.
- risk 0.49cvss 7.5epss 0.01
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited).
- risk 0.47cvss 7.2epss 0.01
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
- risk 0.42cvss 6.5epss 0.00
A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
- risk 0.42cvss 6.5epss 0.01
Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files.
- risk 0.39cvss 6.0epss 0.00
A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.
- risk 0.35cvss 5.3epss 0.01
Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface.
- risk 0.32cvss 4.9epss 0.00
A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
Page 1 of 2