CVE-2020-9502 json
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities.
published 2020-05-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-30308
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
Patch / fix
- dahuasecurity sd6al_firmware 2019-12
- dahuasecurity sd5a_firmware 2019-12
- dahuasecurity sd1a_firmware 2019-12
- dahuasecurity ptz1a_firmware 2019-12
- dahuasecurity sd50_firmware 2019-12
- dahuasecurity sd52c_firmware 2019-12
- dahuasecurity ipc-hx5842h_firmware 2019-12
- dahuasecurity ipc-hx7842h_firmware 2019-12
- dahuasecurity ipc-hx2xxx_firmware 2019-12
- dahuasecurity ipc-hxxx5x4x_firmware 2019-12
- dahuasecurity n42b1p_firmware 2019-12
- dahuasecurity n42b2p_firmware 2019-12
- dahuasecurity n42b3p_firmware 2019-12
- dahuasecurity n52a4p_firmware 2019-12
- dahuasecurity n54a4p_firmware 2019-12
- dahuasecurity n52b2p_firmware 2019-12
- dahuasecurity n52b5p_firmware 2019-12
- dahuasecurity n52b3p_firmware 2019-12
- dahuasecurity n54b2p_firmware 2019-12
- dahuasecurity ipc-hdbw1320e-w_firmware 2019-12
Exploit prediction
1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HFW1431S
Classification
- Weakness
-
- CWE-330 Use of Insufficiently Random Values
References
-
dahuasecurity.com
/support/cybersecurity/details/777
vendor-advisory
Sources
- CVE List CVE-2020-9502
- NVD CVE-2020-9502
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.