CVE-2025-31702

This vulnerability lets an attacker who already has a normal user login “sneak in deeper.” Once inside, they can request admin-only files and use that to change the administrator password—like forcing the building manager to reset the master key so they can fully control the camera system.

This matters if your small business uses and operates affected Dahua IP camera models listed under this CVE. It’s especially relevant when the cameras can be reached over the network in the default configuration.

The key gate: there is no need for a human to click anything, but an attacker must already have valid normal user credentials. Risk becomes real when the device is reachable over the network and those credentials are obtained (for example via credential stuffing or brute force).

This is RED because it is actively exploited in the wild. Reporting describes a campaign that breached large numbers of Dahua IP cameras and used techniques linked to this specific issue to gain control and maintain persistence.