Loading story…
Dahua published advisory DHCC-SA-202606-001 covering three vulnerabilities in IP cameras, PTZ cameras, network video recorders, and related hardware. The most serious issue, CVE-2026-29114, exposes a device CA root certificate, creating a risk of fraudulent certificate issuance where clients trust that CA. Two additional flaws enable denial of service: CVE-2026-29115 lets an authenticated remote attacker crash affected systems, while CVE-2026-29116 allows an unauthenticated attacker to send a specially crafted packet that triggers an exception and forces an unexpected reboot.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Dahua advisory DHCC-SA-202606-001 disclosed CVE-2026-29114, CVE-2026-29115, and CVE-2026-29116 affecting IP cameras, PTZ cameras, NVRs, and other hardware. The issues include certificate exposure and denial-of-service flaws, and the advisory urges customers to apply updated firmware.
NVIDIA issued a June 2026 security bulletin for NVIDIA DALI covering CVE-2026-24180 and CVE-2026-24181, warning that exploitation could lead to code execution, data tampering, denial of service, and information disclosure. NVIDIA advised users to update to or clone DALI version 2.1 or later from the GitHub repository.
A critical double-free vulnerability in strongSwan's libstrongswan component, tracked as CVE-2026-47895, was disclosed as affecting versions since 4.3.3 and potentially enabling unauthenticated remote code execution on vulnerable VPN servers. The strongSwan team released version 6.0.7 and patches for older releases to remediate the issue.
The CVE record states that CVE-2026-29116 was received by cybersecurity@dahuatech.com on June 10, 2026. The flaw affects some Dahua products and allows an unauthenticated remote attacker to trigger an exception reboot, causing denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bitdefender disclosed two serious vulnerabilities in Dahua camera firmware, tracked as **CVE-2025-31700** and **CVE-2025-31701**, that can be exploited by an unauthenticated attacker to achieve remote code execution or trigger denial of service. The flaws affect the **Dahua Hero C1 Smart Camera** and multiple Dahua **IPC, SD, and TPC** camera series, with all firmware released before `2025-04-16` reported as vulnerable. Both vulnerabilities carry a **CVSS 3.1 score of 8.1**, and CSIRT.SK warned that successful exploitation could compromise device integrity and the security of monitored premises. Administrators and camera owners were urged to apply Dahua’s available firmware updates promptly to reduce the risk of takeover or service disruption across exposed surveillance deployments.
Jul 24, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026
Hanwha Vision disclosed patched firmware for two high-severity vulnerabilities affecting its camera and web server components after the flaws were identified by Amazon penetration testing engineers. **CVE-2024-54013** is an authentication bypass issue classified as `CWE-306` that can allow unintended access to protected functions because of a request-handling weakness in a web server component. The company also addressed **CVE-2024-54012**, a command injection flaw classified as `CWE-78`, in which improperly validated input can let specially crafted requests execute malicious commands on affected camera systems. Both CVEs carry CVSS v4.0 ratings indicating high impact to confidentiality, integrity, and availability, and Hanwha Vision directed customers to its advisory for firmware updates, remediation guidance, and available workarounds.
Jun 29, 2026