Read the docs
TI-2019-07085 Aliases CVE-2019-9681GHSA-c3w2-cxh2-39vq

Online upgrade information in some firmware packages of Dahua products is not encrypted.

Priority LOW 25CWE-311Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-311.

Summary

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.

Why it matters now

EPSS 0.00784 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DahuaIPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2XVersions which Build time before August 18 2019—No fix listedCNA
  • IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X VendorDahua Affected Versions which Build time before August 18 2019 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:ipc-hdw1x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hdw1x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hfw1x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hfw1x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hdw2x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hdw2x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hfw2x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hfw2x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hdw4x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hdw4x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hdw1x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hdw1x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hfw1x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hfw1x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hdw2x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hdw2x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hfw2x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hfw2x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hdw4x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hdw4x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:ipc-hfw4x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hfw4x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hdbw4x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hdbw4x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hdw5x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hdw5x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hfw5x2x_firmware:*:*:*:*:*:*:*:*before 2019-08-18VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hfw5x2x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hfw4x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hfw4x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hdbw4x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hdbw4x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hdw5x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hdw5x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hfw5x2x_firmware:*:*:*:*:*:*:*:* Versions before 2019-08-18 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hfw5x2x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9681
  2. 2026-10-03 Alias added: GHSA-c3w2-cxh2-39vq

References

Patch 1

  • TI-2021-12646 Improper authentication in Some Dahua IP Camera, Video Intercom, NVR, XVR devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-12645 Improper authentication in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-03585 Dahua Smart Park Management unrestricted upload CVSS 3.1CRITICAL 9.8
  • TI-2024-12178 Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal CVSS 4.0MEDIUM 5.3
  • TI-2019-02954 Missing authentication in Dahua IPC-XXBXX CVSS 3.0HIGH 7.5
  • TI-2025-43987 Command injection in Dahua Intelligent Connection Center CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences