Skip to content
Fencer Vulns
high 8.1

CVE-2019-9682 json

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal…

published 2020-05-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-19048

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.

Patch / fix

  • dahuasecurity sd6al_firmware 2019-12
  • dahuasecurity sd5a_firmware 2019-12
  • dahuasecurity sd1a_firmware 2019-12
  • dahuasecurity ptz1a_firmware 2019-12
  • dahuasecurity sd50_firmware 2019-12
  • dahuasecurity sd52c_firmware 2019-12
  • dahuasecurity ipc-hx5842h_firmware 2019-12
  • dahuasecurity ipc-hx7842h_firmware 2019-12
  • dahuasecurity ipc-hx2xxx_firmware 2019-12
  • dahuasecurity ipc-hxxx5x4x_firmware 2019-12
  • dahuasecurity n42b1p_firmware 2019-12
  • dahuasecurity n42b2p_firmware 2019-12
  • dahuasecurity n42b3p_firmware 2019-12
  • dahuasecurity n52a4p_firmware 2019-12
  • dahuasecurity n54a4p_firmware 2019-12
  • dahuasecurity n52b2p_firmware 2019-12
  • dahuasecurity n52b5p_firmware 2019-12
  • dahuasecurity n52b3p_firmware 2019-12
  • dahuasecurity n54b2p_firmware 2019-12
  • dahuasecurity ipc-hdbw1320e-w_firmware 2019-12

Exploit prediction

0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • n/a IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HDBW1320E-W

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.