CVE-2026-29116: Dahua Products DoS Vulnerability

CVE-2026-29116 Overview

CVE-2026-29116 is a denial of service vulnerability affecting some Dahua products. An unauthenticated remote attacker can send a specially crafted packet to a vulnerable device, triggering an exception that causes an unexpected reboot. The flaw is classified under CWE-617 (Reachable Assertion) and is exploitable over the network without privileges or user interaction.

Successful exploitation interrupts video surveillance availability and forces affected devices into a reboot cycle. Repeated exploitation can effectively keep targeted devices offline, undermining physical security operations that depend on continuous camera and recorder uptime.

Critical Impact

Unauthenticated attackers can remotely reboot affected Dahua devices by sending a single crafted packet, degrading availability of surveillance infrastructure.

Affected Products

• Dahua products listed in advisory DHCC-SA-202606-001
• Specific affected models and firmware versions are enumerated by the vendor advisory
• Network-reachable Dahua devices exposing the vulnerable service

Discovery Timeline

• 2026-06-10 - CVE-2026-29116 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-29116

Vulnerability Analysis

The vulnerability is a reachable assertion flaw ([CWE-617]) in Dahua product firmware. When the device receives a specifically crafted network packet, internal validation logic reaches an assertion or unhandled exception state. The exception is not recovered gracefully, and the system reboots to restore a known state.

Because the trigger condition is reachable before authentication, any attacker with network access to the affected service can induce the fault. The impact is limited to availability — there is no confirmed compromise of confidentiality or integrity, and no code execution path has been disclosed.

Repeated transmission of the malformed packet can hold devices in a reboot loop. For environments using Dahua devices for perimeter monitoring, this creates blind spots that align with classic denial of service abuse patterns against IoT and IP camera infrastructure.

Root Cause

The root cause is improper handling of malformed input within a network-facing component of the affected Dahua firmware. The device evaluates attacker-controlled fields and triggers an assertion or fatal exception path instead of returning a controlled error. The vendor advisory DHCC-SA-202606-001 is the authoritative source for the affected component.

Attack Vector

The attack vector is network based. The attacker sends a crafted packet to a vulnerable Dahua device exposed on the network. No authentication, privileges, or user interaction are required. Devices reachable from the internet or from untrusted network segments face the highest risk. No public proof of concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Detection Methods for CVE-2026-29116

Indicators of Compromise

• Unexpected reboot events recorded in Dahua device logs without an administrator-initiated trigger
• Loss of video feed or recording gaps correlated with device restart timestamps
• Repeated short-lived disconnects from network video recorders (NVRs) or video management systems (VMS)
• Inbound traffic to Dahua service ports from unexpected external or internal sources prior to reboot events

Detection Strategies

• Monitor syslog or SNMP traps from Dahua devices for repeated reboot or watchdog reset events
• Correlate network flow data with device availability to identify packets preceding device outages
• Alert on unauthenticated connections to Dahua management and streaming ports from non-administrative subnets

Monitoring Recommendations

• Track device uptime metrics and flag devices with reboot frequency above baseline
• Forward Dahua and NVR logs to a centralized SIEM or data lake for correlation with network telemetry
• Apply intrusion detection signatures published by the vendor or community feeds for malformed Dahua protocol traffic

How to Mitigate CVE-2026-29116

Immediate Actions Required

• Review DHCC-SA-202606-001 and inventory affected Dahua models and firmware versions in the environment
• Apply the firmware update specified by Dahua for each affected model as soon as it is available
• Remove direct internet exposure of Dahua devices and place them behind a firewall or VPN
• Restrict management and streaming ports to known administrative source addresses only

Patch Information

Dahua has published advisory DHCC-SA-202606-001 describing the affected products and the corresponding fixed firmware. Apply the patched firmware version listed by the vendor for each affected device model.

Workarounds

• Segment Dahua devices onto a dedicated VLAN with strict ACLs blocking untrusted inbound traffic
• Deny inbound traffic to Dahua devices from the internet at the perimeter firewall
• Rate-limit traffic to Dahua service ports to reduce the impact of repeated exploitation attempts
• Monitor and automatically alert on repeated device reboots so operators can respond to active exploitation

# Configuration example: restrict access to Dahua devices at the firewall
# Replace interface names and subnets with values appropriate for the environment

# Allow management only from the security operations subnet
iptables -A FORWARD -s 10.10.20.0/24 -d 10.50.0.0/24 -p tcp --dport 37777 -j ACCEPT
iptables -A FORWARD -s 10.10.20.0/24 -d 10.50.0.0/24 -p tcp --dport 80 -j ACCEPT

# Drop all other traffic destined for the Dahua device subnet
iptables -A FORWARD -d 10.50.0.0/24 -j DROP