What’s Vulnerable › Vulnerabilities
CVE-2025-31702
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-15 · updated 2026-10-18
- Weakness: CWE-732
Description
A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
Affected products
- Dahua IPC: from Affected products include certain models from the IPC-1XXX, IPC-2XXX, IPC-WX, and IPC-ECXX series, and limited through versions which build time prior to 1st July 2025 (not including 1st July 2025).
- Dahua SD: from Affected products include certain models from the SD3A, SD2A, SD3D, SDT2A, and SD2C series, and limited through versions which build time prior to 1st July 2025 (not including 1st July 2025).
References
Get alerted when CVE-2025-31702 or the next vulnerability affects your stack