Dahua Known Exploited Vulnerabilities

Evidence-backed KEV intelligence for Dahua products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.

Total KEVs

In CISA KEV

Beyond CISA KEV

Sensor Observed

Virtual Patch Available

7 Dahua KEVs added all time (primary attestation date).

Attested CVEs

CVE	Product	Confidence	CISA KEV	Added
CVE-2024-13985 Dahua EIMS capture_handle.action RCE	EIMS	High	Not in CISA	06 Mar 2026
CVE-2025-34059 Dahua Smart Cloud Gateway Registration Management Platform SQL Injection	Smart Cloud Gateway Registration Management Platform	High	Not in CISA	29 Jan 2026
CVE-2023-7309 Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload	Smart Park Integrated Management Platform	High	Not in CISA	11 Nov 2025
CVE-2023-3836 Dahua Smart Park Management unrestricted upload	Smart Park Management	High	Not in CISA	07 Jul 2025
CVE-2017-7927 A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN,...	Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras	High	Not in CISA	27 Apr 2025
CVE-2021-33044 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity...	Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices	Confirmed	In CISA	21 Aug 2024
CVE-2021-33045 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity...	Some Dahua IP Camera, Video Intercom, NVR, XVR devices	Confirmed	In CISA	21 Aug 2024

CWE-434 — Unrestricted Upload of File with Dangerous Type 2
CWE-287 — Improper Authentication 2
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 1
CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor 1
CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 1
CWE-836 — Use of Password Hash Instead of Password for Authentication 1
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 1