Vulnerability Intelligence Report
CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:1.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| dahuasecurity | sd6al_firmware | all |
| dahuasecurity | sd6al | all |
| dahuasecurity | sd5a_firmware | all |
| dahuasecurity | sd5a | all |
| dahuasecurity | sd1a_firmware | all |
| dahuasecurity | sd1a | all |
| dahuasecurity | ptz1a_firmware | all |
| dahuasecurity | ptz1a | all |
| dahuasecurity | sd50_firmware | all |
| dahuasecurity | sd50 | all |
| dahuasecurity | sd52c_firmware | all |
| dahuasecurity | sd52c | all |
| dahuasecurity | ipc-hx5842h_firmware | all |
| dahuasecurity | ipc-hx5842h | all |
| dahuasecurity | ipc-hx7842h_firmware | all |
| dahuasecurity | ipc-hx7842h | all |
| dahuasecurity | ipc-hx2xxx_firmware | all |
| dahuasecurity | ipc-hx2xxx | all |
| dahuasecurity | ipc-hxxx5x4x_firmware | all |
| dahuasecurity | ipc-hxxx5x4x | all |
| dahuasecurity | n42b1p_firmware | all |
| dahuasecurity | n42b1p | all |
| dahuasecurity | n42b2p_firmware | all |
| dahuasecurity | n42b2p | all |
| dahuasecurity | n42b3p_firmware | all |
| dahuasecurity | n42b3p | all |
| dahuasecurity | n52a4p_firmware | all |
| dahuasecurity | n52a4p | all |
| dahuasecurity | n54a4p_firmware | all |
| dahuasecurity | n54a4p | all |
| dahuasecurity | n52b2p_firmware | all |
| dahuasecurity | n52b2p | all |
| dahuasecurity | n52b5p_firmware | all |
| dahuasecurity | n52b5p | all |
| dahuasecurity | n52b3p_firmware | all |
| dahuasecurity | n52b3p | all |
| dahuasecurity | n54b2p_firmware | all |
| dahuasecurity | n54b2p | all |
| dahuasecurity | ipc-hdbw1320e-w_firmware | all |
| dahuasecurity | ipc-hdbw1320e-w | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.719%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Dahua Technologies · Vendor · China |
| Reserved | 2020-03-01T00:00:00 |
| Published | 2020-05-13T15:21:12 |
| Last Updated | 2024-08-04T10:34:38 |
Community Chatter & Buzz