CVE-2020-9502
Some Dahua products with Build time before December 2019 have Session ID predictable...
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
- Record
CVE-2020-9502- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-330
- Updated
- 2026-11-02
CVE List No score
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
- Record
CVE-2020-9502- Updated
- 2026-11-02
EUVDEUVD-2020-30308 No score
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
- Record
EUVD-2020-30308- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqmc-r2j8-rwq3 No score
Some Dahua products with Build time before December 2019 have Session ID predictable...
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
- Record
GHSA-rqmc-r2j8-rwq3- Updated
- 2026-11-02
Affected products
- dahuasecurity ipc-hdbw1320e-w firmware
- dahuasecurity ipc-hx2xxx firmware
- dahuasecurity ipc-hx5842h firmware
- dahuasecurity ipc-hx7842h firmware
- dahuasecurity ipc-hxxx5x4x firmware
- dahuasecurity n42b1p firmware
- dahuasecurity n42b2p firmware
- dahuasecurity n42b3p firmware
- dahuasecurity n52a4p firmware
- dahuasecurity n52b2p firmware
- dahuasecurity n52b3p firmware
- dahuasecurity n52b5p firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9502 is a critical vulnerability (CVSS 9.8) in Dahuasecurity Ipc-hdbw1320e-w Firmware, published May 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. No source names a fixed version.