Which versions of Dahua IPC/NVR Devices are affected by CVE-2026-29116?

Dahua video surveillance infrastructure across multiple product lines (DVRs, NVRs, IP cameras, and access control units) is vulnerable to remote denial-of-service attacks that do not require…

How to fix or mitigate CVE-2026-29116?

Within 24 hours: Inventory all Dahua devices across product lines (IPC, SD, NVR, XVR, EVS, VTO, VTH, ASI, TPC) and restrict network access via firewall rules to authorized management networks only. Within 7 days: Implement network-layer rate limiting and packet filtering on segments hosting Dahua devices; contact Dahua support for confirmed patch timeline. Within 30 days: Deploy vendor patch immediately upon release; if unavailable after 60 days, initiate procurement of alternative surveillance vendors for critical infrastructure.

Dahua IPC/NVR Devices CVE-2026-29116

Q: What is the CVSS score of CVE-2026-29116?

CVE-2026-29116 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35990 HIGH

Reachable Assertion (CWE-617)

2026-06-10 dahua

GHSA-6jj8-ccgg-jxw2

Denial Of Service Dahua

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 09:20 vuln.today

CVSS changed

Jun 10, 2026 - 07:22 NVD

8.7 (HIGH)

CVE Published

Jun 10, 2026 - 06:16 nvd

UNKNOWN (no severity yet)

DescriptionNVD

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.

AnalysisAI

Remote denial-of-service in multiple Dahua video surveillance product lines (IPC, SD, NVR, XVR, EVS, VTO, VTH, ASI, TPC) allows unauthenticated network attackers to send a specially crafted packet that triggers an unhandled exception (CWE-617), forcing the device into an unexpected reboot. The CVSS 4.0 score of 8.7 reflects high availability impact with no required privileges or user interaction, and no public exploit identified at time of analysis.

Technical ContextAI

The flaw is classified as CWE-617 (Reachable Assertion), meaning a network-reachable code path contains an assertion or unhandled exception condition that an attacker can deliberately trigger with malformed input. The affected devices span Dahua's surveillance ecosystem - IP cameras (IPC), speed domes (SD), network/digital/hybrid video recorders (NVR, XVR, EVS), video intercom stations (VTO, VTH), access control (ASI), and thermal cameras (TPC) - all sharing a common firmware lineage indicated by the consolidated CPE string cpe:2.3:a:dahua:ipc/sd/nvr/xvr/evs/vto/vth/asi/tpc:*. These devices typically expose proprietary management protocols and ONVIF/RTSP services on the network, providing the attack surface for the crafted packet.

RemediationAI

Upgrade affected Dahua devices to firmware built on or after March 26, 2026, as published in Dahua PSIRT advisory DHCC-SA-202606-001 (https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001); the advisory is the authoritative source for the per-model build numbers since the input data does not enumerate exact fixed versions. Until firmware is applied, restrict management and streaming ports (typically TCP 37777/Dahua proprietary, 554/RTSP, 80/443, and 8000) to trusted management subnets via firewall ACLs, place all surveillance equipment on an isolated VLAN with no inbound internet exposure, and remove any NAT/port-forward rules pointing at these devices - the trade-off is loss of remote mobile-app access, which can be restored via VPN. Increase monitoring for unexpected device reboots as a detection signal for in-progress exploitation.