Dahua IPC EUVD-2026-35984

The CVSS 4.0 AT:P metric confirms that specific attack prerequisites must be present - the exact configuration state or device condition required to expose the CA certificate endpoint is not detailed in available vendor or NVD data beyond the build date threshold. Unauthenticated network access (PR:N) is sufficient for the initial certificate retrieval step; no account credentials are required. Exploitation of the downstream integrity risk (fraudulent certificate issuance) is additionally gated by: (1) the victim actively installing and trusting the retrieved CA certificate on a client system (UI:P - user interaction required), and (2) the attacker possessing or having access to the CA private key, which is implied by the description but not explicitly confirmed in available data. Limiting factors include: the victim trust-installation step cannot be automated and requires social engineering or physical access to client machines; clients using certificate pinning or operating system-level CA restrictions are unaffected; and only Dahua IPC models with firmware build dates before April 15, 2026 are in scope.

The CVSS 4.0 base score of 2.3 (Low) accurately reflects the conditional and multi-step nature of exploitation. The vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N confirms network reachability requires no authentication (PR:N), but AT:P indicates specific prerequisite attack conditions must be met on the device side, and UI:P requires passive user interaction - practically, a victim must install and trust the extracted CA certificate, which is a non-trivial social engineering step. No EPSS score was provided in available data; no KEV listing exists; no public proof-of-concept exploit has been identified. The direct impact of certificate retrieval alone (VC:L) is low - the integrity risk (VI:L) only materializes if the full downstream abuse chain is completed. This is not a mass-exploitation scenario; the realistic threat is targeted attacks against organizations already using these devices where an adversary has both network access and the ability to influence client certificate trust stores. The absence of scope change (SC:N/SI:N/SA:N in CVSS 4.0 supplemental) further confirms containment to the vulnerable component and directly influenced clients.

An attacker with network access to a Dahua IPC device on a corporate LAN retrieves the device's CA root certificate through the externally accessible endpoint, requiring no authentication. The attacker then deceives an IT administrator or end user into installing the CA certificate as a trusted root on their workstation - for example, by framing it as a required device management certificate. Once trusted, the attacker uses the CA (contingent on also possessing or having derived the corresponding private key) to issue fraudulent TLS certificates for internal domains, enabling transparent HTTPS interception on that client. No public proof-of-concept exploit for this scenario has been identified at time of analysis.