CVE-2019-9681: Dahuasecurity Ipc-HDBW4X2X Firmware

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.

Affected products

• Dahuasecurity Ipc-HDBW4X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HDW1X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HDW2X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HDW4X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HDW5X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HFW1X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HFW2X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HFW4X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)
• Dahuasecurity Ipc-HFW5X2X Firmware: before 2019-08-18 (fixed in 2019-08-18)

Published 2019-09-17. Last modified 2026-06-17.