CVE-2025-31702

This vulnerability lets an attacker who already has a normal user login “sneak in deeper.” Once inside, they can request admin-only files and use that to change the administrator password—like forcing the building manager to reset the master key so they can fully control the camera system.

This matters if your small business uses and operates affected Dahua IP camera models listed under this CVE. It’s especially relevant when the cameras can be reached over the network in the default configuration.

The key gate: there is no need for a human to click anything, but an attacker must already have valid normal user credentials. Risk becomes real when the device is reachable over the network and those credentials are obtained (for example via credential stuffing or brute force).

This is RED because it is actively exploited in the wild. Reporting describes a campaign that breached large numbers of Dahua IP cameras and used techniques linked to this specific issue to gain control and maintain persistence.

1. Confirm exposure

   • Inventory your Dahua IP cameras and identify any that match the affected models: dh-ipc-hfw1230s1-a-s5, dh-ipc-hdw1230t1-a-s5, dh-ipc-hfw1239s1-a-led-s5, dh-ipc-hdw1239t1-a-led-s5, dh-ipc-hfw1230s-a-s5, dh-ipc-hfw1239s1-led-s5, dh-ipc-hdw1230t-a-s5, dh-ipc-hfw1230tl2-s5, dh-ipc-hdw1230t2-s5, dh-ipc-hfw1439tl1-pv.
   • For each device, check the currently installed firmware/software version in the camera’s admin interface.

2. Apply the fix

   • Use Dahua’s Trusted Center guidance for CVE-2025-31702 to determine the fixed firmware version for your exact model and then upgrade accordingly.
   • After upgrading, confirm the device reports the new firmware version and re-test normal camera functions.

3. If patching is delayed (temporary containment)

   • Block public internet access to the cameras (firewall deny rules for internet-sourced traffic; allow only through a VPN or your internal network).
   • Limit exposure of camera services to the minimum required networks/hosts.

4. Post-update security steps

   • Rotate the admin password on each affected device after patching.
   • Check for suspicious logins and any signs of admin password changes in the device logs (and investigate the source IPs if available).

5. What to monitor

   • Repeated login attempts, unusual admin password change events, and any unexpected outbound connections consistent with persistence mechanisms used in reported campaigns.

Severity is reported as medium by the provided scoring, but the overall risk is elevated by confirmed active exploitation in the wild. The weakness is classified as CWE-732 (authorization bypass), where a network attacker can use valid normal user credentials to access admin-restricted data and modify the administrator password.

Attack characteristics from the findings:

• Attack vector: Network; no user interaction required.
• Preconditions: attacker has valid normal user credentials.
• Default reachability: reachable in default configuration (reported as yes).
• Exploitation status: exploitation reported YES via a campaign described as Operation CameraSwarm, including large-scale camera compromises and P2P relay techniques linked to this CVE.

Patch guidance is provided by Dahua’s Trusted Center (linked in the findings). KEV listing is not present for this CVE.

Exploit maturity: at least one public proof-of-concept exists, and real-world compromise evidence is reported, indicating practical weaponization.

Note: EPSS is a prediction and is not used as the deciding factor here because real-world exploitation was reported in the findings.