Dahuasecurity vulnerabilities
We track 12 vulnerabilities in Dahuasecurity products across 60+ products. 12 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on July 31, 2024.
Latest Dahuasecurity vulnerabilities
- 9.8 Critical severity
NVR4XXX and IPC-HX8XXX: Stack-based Buffer Overflow
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
- 7.5 High severity
NVR4XXX: Reachable Assertion
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- 7.5 High severity
NVR4XXX: NULL Pointer Dereference
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- 7.5 High severity
IPC-HX8XXX and NVR4XXX: Allocation of Resources Without Limits or Throttling
A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- 9.8 Critical severity
Smart Park Management: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upl
- 7.5 High severity
DSS Professional, DSS Express…: Improper Access Control
Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated restart o
- 7.5 High severity
DSS Professional, DSS Express…: Server-Side Request Forgery
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
- 7.2 High severity
DSS Professional, DSS Express…: Unrestricted Upload of File with Dangerous Type
Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files.
- 7.5 High severity
DSS Professional, DSS Express…: Use of Hard-coded Credentials
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.
- 7.5 High severity
DSS Professional, DSS Express…: Missing Authentication for Critical Functionality
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited).
- 9.8 Critical severity
Dahua IP Camera Authentication Bypass Exploited
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- 9.8 Critical severity
Dahua IP Camera Authentication Bypass Exploited
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.