PT-2025-42234 · Dahua · Dahua Embedded Products

Published 2025-10-15 · Updated 2026-02-06 · CVE-2025-31702

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dahua embedded products (affected versions not specified)

Description A security issue exists in Dahua embedded products. An attacker gaining normal user credentials can potentially access data restricted to administrator privileges, including system-sensitive files, through specific HTTP requests. This could allow for tampering with the administrator password, potentially leading to privilege escalation. Systems configured with only an administrator account are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-13765

CVE-2025-31702

Affected Products

Dahua Embedded Products

References · 8

• 🔥 https://github.com/purpleghosts/CVE-2025-31702 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-31702 · Security Note
• https://bdu.fstec.ru/vul/2025-13765 · Security Note
• https://twitter.com/CVEnew/status/1978562094128648683 · Twitter Post
• https://twitter.com/packet_storm/status/2001384501176631566 · Twitter Post
• https://t.me/cveNotify/138710 · Telegram Post
• https://labs.itresit.es/2025/10/15/dahua-cve-2025-31702-p2p-auto-update-eop · Note
• https://dahuasecurity.com/aboutUs/trustedCenter/details/777 · Note