Description
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dahua | NVR2-4KS3 | Versions which Build time prior to 3rd March 2026 | — |
| dahua | XVR4232AN-I/T | Versions which Build time prior to 3rd March 2026 | — |
| dahua | XVR1B16H-I/T | Versions which Build time prior to 3rd March 2026 | — |