CVE-2019-9681
Online upgrade information in some firmware packages of Dahua products is not encrypted....
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
- Record
CVE-2019-9681- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
CVE List No score
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
- Record
CVE-2019-9681- Updated
- 2026-11-02
EUVDEUVD-2019-19047 No score
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
- Record
EUVD-2019-19047- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c3w2-cxh2-39vq
Online upgrade information in some firmware packages of Dahua products is not encrypted....
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
- Record
GHSA-c3w2-cxh2-39vq- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
Affected products
- dahua ipc-hdw1x2x,ipc-hfw1x2x,ipc-hdw2x2x,ipc-hfw2x2x,ipc-hdw4x2x,ipc-hfw4x2x,ipc-hdbw4x2x,ipc-hdw5x2x,ipc-hfw5x2x
- dahuasecurity ipc-hdbw4x2x firmware
- dahuasecurity ipc-hdw1x2x firmware
- dahuasecurity ipc-hdw2x2x firmware
- dahuasecurity ipc-hdw4x2x firmware
- dahuasecurity ipc-hdw5x2x firmware
- dahuasecurity ipc-hfw1x2x firmware
- dahuasecurity ipc-hfw2x2x firmware
- dahuasecurity ipc-hfw4x2x firmware
- dahuasecurity ipc-hfw5x2x firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9681 is a medium vulnerability (CVSS 5.3) in Dahua Ipc-hdw1x2x,ipc-hfw1x2x,ipc-hdw2x2x,ipc-hfw2x2x,ipc-hdw4x2x,ipc-hfw4x2x,ipc-hdbw4x2x,ipc-hdw5x2x,ipc-hfw5x2x, published September 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. No source names a fixed version.