CVE-2026-29114 — Dahua Exposed Device CA Root Certificate

Advisory type: Vendor-coordinated security disclosure
CVE ID: CVE-2026-29114
Vendor: Dahua Technology
Published: 2026-06-10T05:44:50 UTC
Last Modified: 2026-06-10T05:44:50 UTC
Source: Dahua Product Security Incident (PSI) Trust Center

Table of Contents

• Executive Summary
• At a Glance
• Relationship to Related CVEs
• Vulnerability Timeline
• Description
• Technical Analysis
• Affected Products
• CVSS Scoring
• Vulnerability Scoring Details
• CWE Classification
• Attack Prerequisites
• Exploitation Scenarios
• Impact Assessment
• Detection and Indicators of Compromise
• Mitigation and Remediation
• Workarounds
• Vendor Response
• References
• Disclaimer
• Document Revision History

Executive Summary

A low-severity certificate-trust vulnerability has been identified in select Dahua IPC (IP camera) models. Under certain deployment conditions, a remote attacker can obtain the device's internal CA root certificate — material that should remain private to the certificate authority hierarchy.

If that root CA (or an intermediate derived from it) has been installed and trusted on client workstations, browsers, or middleware, an attacker who possesses the private key material can mint fraudulent X.509 certificates that validating clients will accept as legitimate. That enables person-in-the-middle (MITM) attacks against HTTPS or TLS-protected sessions that chain to the compromised trust anchor, undermining the confidentiality and integrity of affected client connections.

The published CVSS 4.0 base score is 2.3 (LOW). The relatively low score reflects deployment preconditions (AT:P — attack requirements present) and passive user interaction (UI:P) needed for practical impact, plus Low (not High) direct confidentiality and integrity ratings on the vulnerable device itself. Availability is not impacted (VA:N).

Organizations running affected IPC firmware builds before April 15, 2026 should verify whether device-issued CAs were ever distributed to endpoints, remove untrusted roots from client trust stores, rotate TLS configurations, and upgrade firmware.

Note on advisory labeling: Some indexes title this CVE "Dahua Data Breach." The vendor description concerns exposure of a device CA root certificate and downstream PKI trust abuse — not bulk exfiltration of recorded video or customer databases. This document follows the vendor description and CVSS scoring data.

At a Glance

Relationship to Related CVEs

CVE-2026-29114 was published on 2026-06-10 alongside other Dahua PSI disclosures from the same batch. The issues are distinct in mechanism and impact profile.

Defender takeaway: This CVE is not a camera reboot flaw. It is a PKI hygiene and trust-store problem. Patching matters, but removing improperly trusted device CAs from client machines is often the decisive remediation step.

Vulnerability Timeline

Description

Dahua has reported a vulnerability in some IPC models whereby sensitive certificate authority (CA) material associated with the device can be obtained by a remote party. The vendor states that an attacker may obtain the device's CA root certificate.

Trust-Chain Consequences

X.509 PKI security depends on private keys staying secret and trust anchors being deliberately chosen. If:

1. The device's root CA certificate and corresponding private key (or recoverable signing material) are exposed, and
2. That CA has been installed as a trusted root (or trusted intermediate) on client systems — for example operator PCs, VMS middleware, or corporate browser trust stores,

then an attacker can:

• Issue arbitrary fraudulent certificates appearing valid under that CA
• Intercept or modify TLS-protected traffic between users and services that trust the compromised anchor
• Undermine certificate validation without triggering standard public-CA warnings

CVSS-Scoped Impact

Per the published vector:

• Confidentiality (VC:L) — Low direct impact on the vulnerable IPC
• Integrity (VI:L) — Low direct impact on the vulnerable IPC
• Availability (VA:N) — No availability impact on the device itself
• Subsequent impacts — Not scored (SC:N, SI:N, SA:N)

Practical harm often manifests on client systems that trust the exposed CA, which is why attack requirements and user interaction metrics are elevated in the scoring model.

Technical Analysis

What Is a Device-Embedded CA?

Many embedded devices ship with factory or firmware-bundled PKI to support:

When installers or software packages push the device CA into Windows/macOS/Linux trust stores, every certificate signed by that CA becomes as trusted as a public CA — for those endpoints.

CWE-538 — Externally Accessible Sensitive Material

CWE-538 covers placement of sensitive information (keys, passwords, certificates) into files or directories reachable without adequate protection. Here, the CA root certificate (and potentially key material or recoverable signing secrets, depending on implementation — vendor text emphasizes certificate obtainability) is exposed via a network-reachable path without authentication.

Attack Requirements (AT:P) — What "Present" Implies

AT:P means exploitation or meaningful impact is not universal; additional conditions exist:

Without client-side trust, obtaining the CA certificate alone (public component) is often insufficient for MITM — the private key must also be compromised. Vendor language focuses on obtaining the root CA certificate; defenders should assume the full trust chain may be at risk until firmware analysis or vendor errata clarifies key exposure.

Passive User Interaction (UI:P)

CVSS 4.0 Passive interaction means the victim must perform a voluntary but low-friction action — not necessarily clicking a malicious link. Examples include:

• Opening the camera web UI over HTTPS in a browser that trusts the device CA
• Launching a VMS client that validates against the installed root
• Routine monitoring activity that establishes TLS to a fraudulent endpoint if MITM is already positioned

The user is not required to actively approve a security exception in all deployment models, but some user-driven TLS usage is in the attack path.

Network Attack Surface

Because PR:N and AV:N, the exposure mechanism is reachable without device credentials. Likely classes of exposure (model-dependent, not vendor-specified):

• Unauthenticated HTTP/HTTPS document or download path
• Static file directory on embedded web server
• Debug or factory certificate bundle endpoint
• Misconfigured storage of PEM/DER files under web root

Penetration testers should map certificate file paths on affected IPC firmware revisions through authorized assessments only.

Affected Products

Vendor Summary

Totals: 1 affected vendor · 1 affected product family (IPC, subset of models)

Scope Notes

Model Identification

Dahua does not enumerate every model in the CVE summary line. Operators must:

1. Record exact IPC model number
2. Query firmware build date from device UI, ONVIF, or SDK
3. Cross-check the Dahua PSI bulletin for authoritative affected-model lists
4. Treat integrator-branded OEM variants as Dahua-equivalent when firmware matches

CVSS Scoring

Summary

CVSS 4.0 Metric Breakdown

Why the Score Is LOW Despite Serious PKI Theory

Risk management note: A 2.3 LOW CVE can still justify high operational priority if your standard operating procedure distributed device CAs enterprise-wide.

Vulnerability Scoring Details

Visual summary of the published CVSS 4.0 selector positions:

Exploit Characteristics

Attack Vector:          [Network]  Adjacent  Local  Physical
Attack Complexity:      [Low]      High
Attack Requirements:      None     [Present]
Privileges Required:    [None]     Low      High
User Interaction:         None     [Passive]  Active

Impact on Vulnerable System

Vuln Confidentiality:     None     [Low]      High
Vuln Integrity:           None     [Low]      High
Vuln Availability:      [None]     Low      High

Subsequent System Impact

Subseq Confidentiality: [None]     Low      High
Subseq Integrity:       [None]     Low      High
Subseq Availability:    [None]     Low      High

CWE Classification

Related CWEs (Contextual, Not Assigned)

Attack Prerequisites

Remotely Exploitable: Yes (certificate retrieval); full trust abuse depends on deployment preconditions above.

Exploitation Scenarios

Scenario 1 — Installer Trust Store Pollution

An integrator installs Dahua's client suite on 200 operator PCs, importing the device CA root into Windows Trusted Root Certification Authorities. An attacker retrieves the CA cert and signing key from an internet-exposed IPC, then MITMs HTTPS sessions to the corporate VMS portal from a coffee-shop laptop on the same VPN.

Scenario 2 — Browser Access to Camera Web UI

Operators are trained to browse https://192.168.x.x for quick focus adjustments. The browser trusts the device-issued chain via a previously imported root. An attacker on the LAN presents a forged certificate for the camera IP, intercepting credentials entered into what appears to be a valid TLS session.

Scenario 3 — Supply-Chain Style Fraudulent Service

An attacker signs a fake update manifest or plugin host appearing trusted under the compromised CA. Passive users opening the VMS trigger download validation that succeeds under the rogue chain.

Scenario 4 — Certificate Retrieval Without Immediate MITM

Threat actors archive exposed CA material from Shodan-indexed cameras for later use if keys are crackable, leaked in firmware images, or if clients later install trust during expansion projects.

Scenario 5 — Forensic / Compliance Audit Finding

No active attacker — auditors discover publicly retrievable CA files on field IPCs, failing PKI governance controls and triggering mandatory rotation even without evidence of exploitation.

Impact Assessment

Technical Impact

Business Impact (Contextual)

When LOW CVSS Still Means "Fix Now"

Prioritize urgent remediation if any of the following are true:

• Device CA installed on >1 corporate endpoint
• CA trust pushed via Group Policy or MDM
• Cameras are WAN-exposed
• Integrator gold images include Dahua roots by default

Detection and Indicators of Compromise

Device-Side Indicators

• Network requests fetching *.pem, *.crt, *.cer, or ca paths without authentication in HTTP logs
• Shodan/Censys indexed certificate files on camera web roots
• Firmware images containing static private keys (authorized binary analysis)

Client-Side Indicators

• Unexpected Dahua-branded or device-serial CAs in:
  • Windows: certlm.msc → Trusted Root Certification Authorities
  • macOS: Keychain Access → System Roots
  • Linux: /usr/local/share/ca-certificates/, /etc/pki/
• TLS connections to cameras showing locally issued chains where public CAs were expected
• VMS installer directories containing rootCA.crt or similar bundled files

Network Indicators

• MITM infrastructure presenting certificates chaining to a non-public issuer matching device CA distinguished names
• Duplicate CA serial numbers across geographically separate devices (factory-shared root concern)

Audit Commands (Examples)

Windows PowerShell — list trusted roots with "Dahua" or device OEM strings:

Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -match 'Dahua|OEM|IPC' } | Format-List Subject, Thumbprint, NotAfter

Linux — search imported local CAs:

grep -ri 'dahua\|BEGIN CERTIFICATE' /usr/local/share/ca-certificates/ /etc/ssl/certs/ 2>/dev/null

Mitigation and Remediation

Primary Remediation — Firmware Update

1. Inventory IPC units with model, serial, and firmware build date.
2. Identify devices with builds before April 15, 2026.
3. Upgrade to vendor-fixed firmware per Dahua PSI Trust Center.
4. After upgrade, verify CA material is no longer externally retrievable (authorized retest).

Trust Store Remediation (Critical)

PKI Best Practices for IPC Deployments

Network Controls

• Block unauthenticated administrative URLs from untrusted networks
• Restrict camera web UI access to jump hosts
• Inspect egress from cameras only as policy allows; focus on inbound exposure of cert files

Coordinated Fleet Hygiene

On estates also affected by CVE-2026-29115 or CVE-2026-29116, combine firmware upgrades — but note different build cutoffs (this CVE: 2026-04-15 vs. 2026-03-26 for the DoS issues).

Workarounds

Until firmware is patched:

1. Do not install newly discovered device CA roots on any client.
2. Remove existing trust for Dahua/device-issued roots where already deployed.
3. Block network access to paths known to serve certificate files (temporary WAF or ACL rules — model-specific).
4. Access cameras via VPN and treat TLS warnings seriously; do not silence warnings globally.
5. Use VMS/SDK tunneled connections that do not depend on trusting the camera's embedded HTTPS CA.

There is no purely configurative fix on the device that substitutes for firmware correction if the CA material remains externally accessible in vulnerable builds.

Vendor Response

Dahua published this issue through its Product Security Incident (PSI) program:

• Trust Center / PSI: https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psi

Consult the vendor bulletin for:

• Exact affected IPC model list
• Fixed firmware versions and build dates
• Any official guidance on trust store cleanup

References

Disclaimer

This document is an informational security advisory compiled from publicly available CVE metadata and vendor statements. It is intended to assist defenders, integrators, and researchers in understanding CVE-2026-29114 risk and prioritizing remediation.

• This README does not provide exploit code, private key extraction recipes, or unauthorized scanning instructions.
• Inferred technical analysis is not vendor-confirmed implementation detail.
• Model and firmware applicability must be verified against official Dahua PSI guidance.
• Trust store and PKI changes can break legitimate access if applied without testing — follow change management practices.
• The authors are not liable for actions taken based on this document.

Responsible use: Conduct certificate exposure checks only on systems you own or are authorized to test. Report additional findings through coordinated disclosure channels.

Document Revision History

_{CVE-2026-29114 · Dahua Technology · CVSS 4.0 2.3 LOW · CWE-538 · IPC}