CVE-2025-31702

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.

• CWE-732

• https://www.dahuasecurity.com/aboutUs/trustedCenter/details/777

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-31696Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-31697Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-31698ACL configured in ip_allow.config or remap.config does not u…7.5
• CVE-2025-3170A vulnerability classified as critical has been found in Pro…9.8
• CVE-2025-31700A vulnerability has been found in Dahua products. Attackers…8.1
• CVE-2025-31701A vulnerability has been found in Dahua products. Attackers…8.1
• CVE-2025-31703A vulnerability found in Dahua NVR/XVR device. A third-party…2.4
• CVE-2025-3171A vulnerability classified as critical was found in Project …9.8
• CVE-2025-31710In engineermode service, there is a possible command injecti…8.4
• CVE-2025-31711In cplog service, there is a possible system crash due to nu…6.2
• CVE-2025-31712In cplog service, there is a possible out of bounds write du…6.2
• CVE-2025-31713In engineer mode service, there is a possible command inject…8.4