Dahua NVR/XVR Privilege Escalation Vulnerability via Serial Port

A vulnerability exists in Dahua NVR and XVR devices, allowing a third-party attacker with physical access to the device to access a restricted shell through the serial port. This access bypasses the shell's authentication, enabling privilege escalation.

Impact

Exploitation of this vulnerability allows unauthorized access to a restricted shell, with the potential to escalate privileges on the device.

Remediation

Users are advised to upgrade to the latest software version available on the Dahua Official website or through local technical support. For products with cloud upgrade capabilities, the patched version can be obtained via cloud upgrade.