CVE-2020-9502: Dahuasecurity Ipc-HDBW1320E-W Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.

Affected products

• Dahuasecurity Ipc-HDBW1320E-W Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HX2XXX Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HX5842H Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HX7842H Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity Ipc-HXXX5X4X Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b1p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n42b3p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52a4p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b3p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n52b5p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n54a4p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity n54b2p Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity PTZ1A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD1A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD50 Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD52C Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD5A Firmware: before 2019-12 (fixed in 2019-12)
• Dahuasecurity SD6AL Firmware: before 2019-12 (fixed in 2019-12)

Published 2020-05-13. Last modified 2026-06-17.