Millions at Risk as Dahua Camera Flaws Allow Remote Code Execution

What Happened: Dahua Firmware Flaws Enable Remote Hijack

In late July 2025, cybersecurity researchers revealed critical security flaws in the firmware of popular Dahua smart surveillance cameras, allowing unauthenticated attackers to seize control remotely via ONVIF protocol and file-upload vulnerabilities.

Two specific vulnerabilities—CVE‑2025‑31700 and CVE‑2025‑31701—affect models within the IPC‑1XXX, IPC‑2XXX, SD2A, SD3A, and SDT2A series that have firmware built before April 16, 2025.

Attackers can exploit these buffer overflow flaws by sending crafted malicious packets (via ONVIF or RPC upload interfaces), resulting in remote code execution (RCE), effectively giving root-level access with no authentication needed. This means live stream control, firmware manipulation, or even persistent malware installation.

Why It Matters: Risk to Business & Legal Compliance

For General Audience:

• Your security camera could be hijacked, revealing live video, being used as a tool for spying, or turning into part of a botnet.
• Cameras exposed to the Internet (via port forwarding or UPnP) are particularly vulnerable.
• Attackers may load unsigned payloads or persistent processes, making remediation difficult.

For Legal / Compliance Professionals:

• Surveillance data often includes video recordings, timestamps, IP addresses — these count as personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
• Under MeitY’s BNS regulations, manufacturers and deployers must implement device audits, secure design protocols, and incident notification procedures for vulnerabilities impacting “critical infrastructure.”
• A breach involving surveillance devices used in telecom, retail, or logistics may trigger mandatory reporting to CERT‑IN within 72 hours, and potential penalties under DPDP (up to ₹50 crore) or BNS enforcement.

Technical Terms Demystified

●      Remote Code Execution (RCE): When an attacker can run arbitrary code on a device over the network.

• ONVIF protocol: Standardized interface used by IP cameras for management and video streams.
• Buffer overflow: A programming flaw where malformed input overwrites memory, enabling attackers to hijack execution.
• RPC (Remote Procedure Call): Functionality that allows file uploads or commands to be executed; weakness here can be abused.
• Unauthenticated access: Exploit works without any valid credentials attackers don’t need login info.
• Root-level access: Full system-level control equivalent to admin privileges.

Incident Timeline & Root Cause

1. Vulnerability discovery: Researchers (e.g., Bitdefender) documented stack-based buffer overflows in ONVIF handler (CVE‑2025‑31700) and file upload functionality (CVE‑2025‑31701) in affected firmware builds before mid‑April 2025.
2. Exploit scenario: Crafted malicious packets sent over LAN or Internet cause code execution or device crash (DoS).
3. Security advisory: Bitdefender and other firms published proof‑of‑concept details and urged firmware updates.
4. Firmware patch release: Dahua issued firmware updates to patch these flaws; customers must check build dates and upgrade.

Broader Context: Why This Isn’t Isolated

Dahua has a documented history of camera and DVR vulnerabilities:

• In 2017, a major bug enabled remote login bypass and control, widely exploited in botnets like Mirai.
• Additional earlier flaws in ONVIF WS‑UsernameToken authentication allowed replay attacks leading to full device access.
• A 2024 security advisory disclosed multiple CVE‑rated flaws requiring urgent firmware updates across numerous models.

Collectively, these highlight a pattern where security is treated as an afterthought in product design, rather than integrated at inception.

Legal & Compliance Imperatives Post-Breach

Under DPDP Act 2023:

• Surveillance data qualifies as personal data; breaches involving video or IP data trigger notification duties.
• Organizations must minimize data collection, ensure encryption, and maintain audit trails.

Under MeitY’s BNS Rules:

• Entities operating critical physical infrastructure (e.g. telecom, warehouses) must conduct regular firmware risk assessments, maintain secure configurations, and enforce incident response protocols.

International Standards Alignment:

• GDPR-like breach reporting and vendor due diligence concepts are quickly becoming global norms.
• Frameworks like NIST CSF and ISO 27001 emphasize secure IoT design, regular patching, and zero‑trust principles.

Non-compliance could lead to audits, liability actions, and reputational harm.

What To Do: Technical & Legal Mitigation Strategy

Partnering with experts can help you secure devices and comply with applicable laws. Recommended steps include:

Technical Steps:

• Firmware audits & updates: Immediately log in to affected Dahua cameras, check build date (via Settings → System Info) and apply vendor patches.
• Network hardening: Disable UPnP/port forwarding. Restrict camera access behind secure VPNs.
• Zero-Trust for IoT: Isolate cameras in segmented VLANs; enforce strict firewall rules and multi-factor authentication.
• Vulnerability scans: Run device-level pen tests focusing on ONVIF and upload interfaces.

Legal / Policy Steps:

• Draft incident response plans including surveillance device scenarios.
• Issue Breach Notification Templates under BNS & DPDP for timely CERT‑IN or DPA responses.
• Include vendor clauses in procurement contracts requiring secure firmware management, patch rights, and periodic assessments.

Related News & Emerging Trends

• Similar flaws in mass-deployed IoT devices have fueled Mirai-style botnets and DDoS attacks globally.
• Reports from Trend Micro, IPVM, and Positive Technologies repeatedly show insecure IoT devices used widely in critical environments.
• There’s growing enforcement: e.g. bans on Chinese surveillance hardware in the UK, U.S., Australia due to security and privacy concerns.

Conclusion

The recent disclosure of critical RCE flaws in Dahua cameras (CVE‑2025‑31700 & CVE‑2025‑31701) underscores the urgent need for firmware updates and secure configuration. These flaws threaten privacy, operational integrity, and regulatory compliance under DPDP Act and BNS rules. Organizations must act swiftly to patch devices, segment networks, test for vulnerabilities, and adopt incident response protocols. Partnering with experts can help ensure a technically secure and legally compliant posture in the age of insecure IoT devices.

Also read about PAN 2.0 Trap: How to Stay Safe and What the Law Says