Cybersecurity researchers have uncovered serious security vulnerabilities in Dahua smart camera firmware that could enable attackers to completely hijack affected devices. The flaws have since been patched by the manufacturer.
## The Vulnerabilities
According to Bitdefender’s security report, two critical flaws affect the cameras’ ONVIF protocol and file upload systems. These vulnerabilities allow unauthorized attackers to execute commands remotely without any authentication, essentially giving them full control over the devices.
The security issues are tracked as:
– **CVE-2025-31700** (CVSS score: 8.1) – A stack-based buffer overflow in the ONVIF request handler
– **CVE-2025-31701** (CVSS score: 8.1) – A buffer overflow in the RPC file upload handler
## Affected Devices
The vulnerabilities impact multiple Dahua camera series with firmware built before April 16, 2025:
– IPC-1XXX Series
– IPC-2XXX Series
– IPC-WX Series
– IPC-ECXX Series
– SD3A, SD2A, SD3D Series
– SDT2A, SD2C Series
Users can check their device’s build date by accessing Settings > System Information > Version in the camera’s web interface.
## How the Attacks Work
Both vulnerabilities are buffer overflow flaws that can be exploited by sending specially crafted malicious data packets to the cameras. Successful attacks can result in:
– Complete system denial-of-service
– Remote code execution with root-level access
– Installation of persistent malware that survives reboots
While some devices include Address Space Layout Randomization (ASLR) protection that may reduce successful code execution, denial-of-service attacks remain highly effective.
## Risk Assessment
The security flaws pose significant risks because:
– No user authentication is required for exploitation
– Attacks can be launched over local networks
– Devices exposed to the internet through port forwarding or UPnP face elevated risk
– Successful attacks bypass firmware security checks, allowing unsigned code installation
Given that these cameras are widely deployed in retail stores, casinos, warehouses, and homes for video surveillance, the potential impact is substantial.
## Recommendations
Users should immediately update their Dahua camera firmware to versions released after April 16, 2025. Organizations should also review network configurations to limit internet exposure of these devices and implement additional network security measures where possible.