Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp.

published 2023-02-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52418

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time.

Patch / fix

fixed in 20

dahuasecurity ipc-hf71242f-z-x_firmware 2.800.0000000.4.r.210708
dahuasecurity ipc-hf7442f-z-x_firmware 2.800.0000000.4.r.210708
dahuasecurity ipc-hf7842f-z-x_firmware 2.800.0000000.4.r.210708
dahuasecurity ipc-hf5241f-ze_firmware 2.840.0000000.18.r.220629
dahuasecurity ipc-hf5442f-ze_firmware 2.840.0000000.18.r.220629
dahuasecurity ipc-hf5541f-ze_firmware 2.840.0000000.18.r.220629
dahuasecurity ipc-hf5842f-ze_firmware 2.840.0000000.18.r.220629
dahuasecurity sd5a225gb-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a225gb-hnr-sl_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a225xa-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a225xa-hnr-sl_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a232gb-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a232xb-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a232xb-hnr-ac_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a232xb-hnr-p_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a245gb-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a245xa-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a425ga-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a425xa-hnr_firmware 2.812.0000032.2.r.220804
dahuasecurity sd5a432gb-hnr_firmware 2.812.0000032.2.r.220804

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 19 mo ago (2025-03-25)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

n/a IPC-HX5XXX,IPC-HX7XXX,SD5A,SD22,SD59,NVR5XXX-I,NVR5XXX-I/L,NVR4XXX-I,NVR2XXX-I,XVRXXXX-I2,XVRXXXX-X

Classification

Weakness

CWE-284 Improper Access Control

References

dahuasecurity.com /support/cybersecurity/details/1147
vendor-advisory

Sources

CVE List CVE-2022-30564
NVD CVE-2022-30564

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary