CVE-2025-31702: Medium severity Dahua embedded products vulnerability
A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31702?
CVE-2025-31702 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive data.
How can I mitigate the risks associated with CVE-2025-31702?
To mitigate CVE-2025-31702, users should ensure that only trusted users have access to normal user credentials and regularly review access controls.
What kind of exploitation is possible with CVE-2025-31702?
CVE-2025-31702 allows a third-party attacker with normal user credentials to access data restricted to admin privileges through specific HTTP requests.
Which products are affected by CVE-2025-31702?
CVE-2025-31702 affects certain Dahua embedded products that have not properly restricted data access.
Is there a patch available for CVE-2025-31702?
Currently, there is no specific patch mentioned for CVE-2025-31702, so it is recommended to follow security best practices to limit exposure.