CVE-2020-9499: Dahuasecurity Ipc-HX2XXX Firmware

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.

Affected products

• Dahuasecurity Ipc-HX2XXX Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HX5842H Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HX7842H Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HXXX5X4X Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b1p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b3p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52a4p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b3p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b5p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n54a4p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n54b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity PTZ1A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD1A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD50 Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD52C Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD5A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD6AL Firmware: before 2019-12 (fixed in 2019-12)

Published 2020-04-09. Last modified 2026-06-17.