CVE-2026-29115 — Dahua Authenticated Remote Denial of Service

Advisory type: Vendor-coordinated security disclosure
CVE ID: CVE-2026-29115
Vendor: Dahua Technology
Published: 2026-06-10T06:08:21 UTC
Last Modified: 2026-06-10T06:08:21 UTC
Source: Dahua Product Security Incident (PSI) Trust Center

Table of Contents

• Executive Summary
• At a Glance
• Relationship to CVE-2026-29116
• Vulnerability Timeline
• Description
• Technical Analysis
• Affected Products
• CVSS Scoring
• Vulnerability Scoring Details
• CWE Classification
• Attack Prerequisites
• Exploitation Scenarios
• Impact Assessment
• Detection and Indicators of Compromise
• Mitigation and Remediation
• Workarounds
• Vendor Response
• References
• Disclaimer
• Document Revision History

Executive Summary

A medium-severity, authenticated remote denial-of-service vulnerability has been identified in select Dahua IPC (IP camera) and SD (speed dome / PTZ) products. An attacker who already possesses valid device credentials can send a specially crafted network packet to a vulnerable unit. Processing that packet triggers an unhandled exception (consistent with a reachable assertion or fatal error path), causing the device to reboot unexpectedly.

Unlike its sibling disclosure CVE-2026-29116, which requires no authentication, this flaw demands high privileges (PR:H) on the target device. That constraint reduces practical exploitability for opportunistic internet-wide attackers, but the risk remains material in environments where camera credentials are shared, default, leaked, or recoverable — a common condition in legacy CCTV deployments.

The vulnerability does not demonstrate direct confidentiality or integrity impact in the published CVSS vector. Availability impact is rated High, producing a CVSS 4.0 base score of 6.9 (MEDIUM).

Organizations operating affected Dahua IPC or SD hardware with firmware builds prior to March 26, 2026 should patch, rotate credentials, and restrict management-plane access.

Note on advisory labeling: Some indexes title this CVE "Dahua Buffer Overflow." The vendor description, CVSS metrics (VA:H only), and CWE-617 (Reachable Assertion) classification describe a crash/reboot denial-of-service after authenticated packet delivery — not a scored memory-corruption confidentiality/integrity breach. This document follows the vendor description and scoring data. Buffer handling may still be part of the underlying defect, but the published impact is availability-only.

At a Glance

Relationship to CVE-2026-29116

Both CVEs were published on 2026-06-10 from the same Dahua PSI disclosure batch. They share structural similarities but differ in scope and attacker model.

Defender takeaway: Patch both issues on overlapping IPC/SD estates. Prioritize 29116 for internet-exposed devices (unauthenticated). Prioritize 29115 where operator or integrator credentials are widely known, stored in VMS databases, or embedded in mobile apps.

Vulnerability Timeline

Description

Dahua has reported a security vulnerability affecting certain models within its IPC and SD product lines. The flaw exists in network-accessible software that accepts authenticated sessions and processes attacker-influenced protocol data without sufficient validation or safe failure handling.

Observed behavior:

1. An authenticated remote attacker with high privileges on the device transmits a specially crafted packet over the network.
2. The device's handler processes the packet and enters an exceptional code path — for example, a failed assertion, unhandled fault, or unrecoverable internal error consistent with CWE-617 (Reachable Assertion).
3. The exception causes the system to reboot unexpectedly.
4. The camera or speed dome remains unavailable until the reboot completes. Repeated exploitation can cause sustained denial of service.

What this vulnerability is not (per CVSS metrics):

• It does not require victim user interaction such as opening a malicious link (UI:N).
• It does not demonstrate direct confidentiality impact (VC:N).
• It does not demonstrate direct integrity impact (VI:N).
• It does not show subsequent-system impact (SC:N, SI:N, SA:N).

What distinguishes it from unauthenticated variants:

• The attacker must already hold credentials sufficient to satisfy the device's high privilege threshold (PR:H). In practice this often maps to administrative or equivalent device-level accounts rather than read-only monitoring users — exact role mapping is product-specific and should be confirmed against vendor documentation.

Technical Analysis

Root Cause (Inferred)

Public vendor text does not disclose the vulnerable function, service name, or exact buffer dimensions. Based on the published CWE, title, and behavior, plausible root-cause categories include:

The published outcome is reboot-level availability loss, not proven remote code execution or data exfiltration in the CVSS record.

Why "Buffer Overflow" May Appear in Titles

CVE titles are not always precise. A buffer overflow class defect can manifest as:

• Immediate crash (availability impact only)
• Controlled memory corruption (potential RCE — not scored in this CVE record)

Here, vendor scoring limits impact to availability, suggesting either non-exploitable corruption, abort-before-exploitation, or vendor assessment that practical integrity/confidentiality outcomes are not achieved.

Attack Surface (Authenticated Plane)

Because exploitation requires high privileges, the relevant surface is typically the management and configuration API available after login, not anonymous discovery endpoints. Depending on model and firmware, that may include:

• Authenticated HTTP/HTTPS configuration APIs
• Device maintenance and upgrade interfaces
• PTZ / lens control channels on SD products
• Proprietary configuration tunnels reachable post-authentication
• SDK-integrated management sessions used by VMS platforms

Attackers with credentials harvested from VMS databases, installer laptops, or default admin accounts can reach these planes from anywhere the management port is exposed.

IPC vs. SD Operational Differences

SD reboots may take longer to return to calibrated PTZ state, extending effective downtime beyond raw boot time.

Affected Products

Vendor Summary

Totals: 1 affected vendor · 1 affected product grouping (IPC + SD)

Product Family Reference

Out-of-Scope Families (This CVE)

The following Dahua lines are not listed for CVE-2026-29115 (though they may be affected by other CVEs such as CVE-2026-29116):

• NVR, XVR, EVS (recorders / storage)
• VTO, VTH (video intercom)
• ASI (access / security interfaces)
• TPC (thermal / specialty)

Model Scope Caveat

Only certain models within IPC and SD are affected. Operators must verify:

1. Exact model number
2. Firmware build date (fixed builds: on or after 2026-03-26)
3. Official Dahua PSI model matrix

CVSS Scoring

Summary

CVSS 4.0 Metric Breakdown

Why PR:H Lowers the Score vs. CVE-2026-29116

PR:H is the primary score differentiator versus the unauthenticated sibling:

6.9 MEDIUM should not be read as "low priority everywhere." In credential-weak CCTV environments, authenticated camera attacks are routine.

Vulnerability Scoring Details

Visual summary of the published CVSS 4.0 selector positions:

Exploit Characteristics

Attack Vector:          [Network]  Adjacent  Local  Physical
Attack Complexity:      [Low]      High
Attack Requirements:    [None]     Present
Privileges Required:      None     Low      [High]
User Interaction:       [None]     Passive  Active

Impact on Vulnerable System

Vuln Confidentiality:   [None]     Low      High
Vuln Integrity:         [None]     Low      High
Vuln Availability:      [High]     Low      None

Subsequent System Impact

Subseq Confidentiality: [None]     Low      High
Subseq Integrity:       [None]     Low      High
Subseq Availability:    [None]     Low      High

CWE Classification

CWE-617 in Authenticated Contexts

Authenticated vulnerabilities are often dismissed as "only insiders." In surveillance networks:

• Integrator accounts are shared across customer sites
• VMS servers store device passwords centrally
• Default credentials survive for years on isolated VLANs
• Former employees retain admin access absent rotation

A reachable assertion behind the authenticated management plane is therefore still a material risk, especially paired with credential reuse.

Buffer Overflow vs. CWE-617

If the underlying defect involves memory corruption, CWE-617 may reflect the observable production behavior (fatal abort) rather than the full weakness taxonomy. Defenders should patch regardless of index naming.

Attack Prerequisites

Remotely Exploitable: Yes (once credentials and network path exist)

Exploitation Scenarios

Scenario 1 — Disgruntled Insider

A technician with admin credentials for all site cameras sends crafted packets to IPC endpoints during off-hours, repeatedly rebooting critical coverage zones.

Scenario 2 — Stolen VMS Password Vault

An attacker exfiltrates the camera password database from a compromised Milestone / Genetec / custom VMS host. They remotely reboot every Dahua IPC on the customer's WAN without further privilege escalation.

Scenario 3 — Default Credential Sweeps

An attacker authenticates with factory defaults (admin / known password lists) on internet-exposed cameras, then triggers reboot loops to harass or blind monitoring during a physical intrusion elsewhere on the property.

Scenario 4 — SD PTZ Sabotage During Active Tracking

A stadium speed dome tracks a security event. Authenticated crafted input reboots the SD unit, losing active PTZ tracking and preset positioning during a critical window.

Scenario 5 — Post-Initial-Compromise Lateral Noise

After phishing an installer laptop, an attacker uses stored credentials to disrupt cameras — degrading forensic capture while a separate team conducts physical entry.

Impact Assessment

Technical Impact

Business Impact (Contextual)

Auth Barrier vs. Real-World Risk

Detection and Indicators of Compromise

No public packet signature is documented. Focus on authenticated session abuse correlated with reboot events.

Host / Device Indicators

• Unexpected reboots following authenticated management sessions from unusual source IPs
• Fatal error or assertion messages in device logs immediately before restart
• Short uptimes after admin API activity
• SD units losing PTZ calibration flags after unplanned reboot

Authentication Indicators

• Admin login successes from geolocations or subnets not used by operators
• Burst of authenticated API calls from a single account across many cameras
• Off-hours configuration sessions without change tickets
• Use of legacy integrator accounts thought to be retired

Network Indicators

• Management port traffic (HTTP/S, proprietary SDK ports) immediately preceding offline events
• Repeated identical payload sizes or anomalous request patterns post-login
• Correlation between VPN egress IP and camera syslog reboot timestamps

Recommended Actions

• Enable syslog on IPC/SD devices to centralized SIEM
• Alert on mass disconnect from VMS within short intervals
• Correlate authentication logs with watchdog reboot events
• Audit accounts with admin privileges; remove unused integrator logins

Mitigation and Remediation

Primary Remediation — Firmware Update

1. Inventory all Dahua IPC and SD units with model, serial, and firmware build date.
2. Flag devices with builds before March 26, 2026.
3. Obtain fixed firmware from the Dahua PSI Trust Center.
4. Upgrade during maintenance windows; verify streams, PTZ presets, and analytics after reboot.
5. Confirm build date in device UI or ONVIF/SDK query post-patch.

Credential Hygiene (Critical for PR:H Flaws)

Network Controls

Coordinated Patching with CVE-2026-29116

On IPC/SD estates, apply firmware that addresses both CVE-2026-29115 and CVE-2026-29116. The unauthenticated issue is strictly worse from an exposure standpoint; authenticated issues remain dangerous where secrets are weak.

Workarounds

No configuration-only workaround is documented that fully removes the vulnerability without upgrading firmware. Until patched:

1. Rotate and harden credentials — reduces who can meet PR:H.
2. Restrict management access to trusted subnets and VPN only.
3. Monitor for reboot loops and block offending sources at the firewall.
4. Disable remote admin on cameras that only need outbound cloud/P2P connectivity (architecture-dependent).

Vendor Response

Dahua published this issue through its Product Security Incident (PSI) program:

• Trust Center / PSI: https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psi

Consult the vendor bulletin for:

• Model-specific affected IPC/SD lists
• Fixed firmware images and release notes
• Any additional hardening guidance

References

Disclaimer

This document is an informational security advisory compiled from publicly available CVE metadata and vendor statements. It is intended to assist defenders, integrators, and researchers in understanding CVE-2026-29115 risk and prioritizing remediation.

• This README does not provide exploit code, crafted packet templates, or attack recipes.
• Inferred technical analysis is not vendor-confirmed root-cause disclosure.
• Model and firmware applicability must be verified against official Dahua PSI guidance.
• The authors are not liable for actions taken based on this document.

Responsible use: Report additional findings through coordinated disclosure (vendor PSI, CERT, or authorized bug bounty programs).

Document Revision History

_{CVE-2026-29115 · Dahua Technology · CVSS 4.0 6.9 MEDIUM · CWE-617 · IPC / SD}