Dahua IPC/SD CVE-2026-29115

Exploitation requires a valid high-privilege authenticated session on the target device (CVSS PR:H confirmed from the CVSS 4.0 vector). The attack is delivered over the network (AV:N) with no additional attack requirements (AT:N) and requires no user interaction (UI:N). Only certain models of Dahua IPC and SD devices are affected; devices with firmware built on or after March 26, 2026 are not vulnerable per vendor advisory. Exploitation is limited by the requirement for high-privilege credentials - unauthenticated or low-privilege users cannot trigger this condition. No special non-default configuration or specific deployment mode is described as a prerequisite beyond possessing a high-privilege account.

The CVSS 4.0 base score of 6.9 (Medium) reflects an important limiting factor: PR:H (High Privileges Required), meaning exploitation requires an already-authenticated, high-privilege session on the targeted device. This significantly narrows the realistic threat actor pool to insiders, compromised credential holders, or attackers who have already achieved initial access. The vulnerability has purely availability impact (VA:H); there is no confidentiality or integrity exposure. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. The net real-world risk is moderate: the attack is network-accessible and low-complexity once authenticated, but the high-privilege prerequisite and availability-only impact mean this is unlikely to be a primary attack vector for sophisticated threat actors. The primary risk is to operational continuity of surveillance infrastructure, particularly in environments where camera availability is mission-critical.

An attacker who holds a high-privilege account on a Dahua IPC or SD device - whether through legitimate credentials, credential theft, or prior compromise - connects to the device over the network and transmits a specially crafted packet designed to trigger the reachable assertion in the firmware. The assertion fires, the firmware process terminates abnormally, and the device reboots, causing a disruption in video recording or surveillance coverage for the duration of the restart cycle. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the crafted packet structure would not require significant expertise to reproduce once the vulnerability is characterized.