A critical buffer overflow vulnerability in multiple Dahua IPC and SD camera models exposes devices to potential remote code execution and denial of service attacks by unauthenticated network actors.

This is a buffer overflow vulnerability triggered by sending specially crafted malicious packets to the affected device. The vulnerability is exploitable by an unauthenticated attacker over the network.

The vulnerability carries a CVSS score of 8.1, reflecting its potential for total system impact including remote code execution and service disruption. Successful exploitation could allow an attacker to gain unauthorized control over surveillance hardware, leading to privacy breaches, potential lateral movement within the network, or the complete loss of camera availability.

Immediate Action: Identify affected units in your environment and apply the latest firmware updates provided by Dahua as specified in their security advisory. If a firmware update is not yet available for a specific model, restrict network access to the device to trusted management segments only.

Proactive Monitoring: Monitor network traffic for anomalous packet patterns directed at camera management interfaces. Review device logs for unexpected service restarts or crash events that may indicate attempted exploitation.

Compensating Controls: Implement network segmentation to isolate camera management interfaces from the public internet or untrusted internal segments. Utilize a Web Application Firewall or network-based intrusion detection system to filter malicious traffic targeting the affected endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability, administrators should prioritize the identification of vulnerable Dahua hardware within their networks. Ensure that all devices are brought to a firmware version released after April 16, 2025, to mitigate the risk of buffer overflow exploitation. Immediate patching or network isolation is required to prevent unauthorized access or system disruption.