CVE-2020-9502
Status: ModifiedCritical (9.8)—
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.53%
- Percentile among all scored CVEs: 74
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (20)
Dahuasecurity — Ipc-hdbw1320e-w FirmwareDahuasecurity — Ipc-hx2xxx FirmwareDahuasecurity — Ipc-hx5842h FirmwareDahuasecurity — Ipc-hx7842h FirmwareDahuasecurity — Ipc-hxxx5x4x FirmwareDahuasecurity — N42b1p FirmwareDahuasecurity — N42b2p FirmwareDahuasecurity — N42b3p FirmwareDahuasecurity — N52a4p FirmwareDahuasecurity — N52b2p FirmwareDahuasecurity — N52b3p FirmwareDahuasecurity — N52b5p FirmwareDahuasecurity — N54a4p FirmwareDahuasecurity — N54b2p FirmwareDahuasecurity — Ptz1a FirmwareDahuasecurity — Sd1a FirmwareDahuasecurity — Sd50 FirmwareDahuasecurity — Sd52c FirmwareDahuasecurity — Sd5a FirmwareDahuasecurity — Sd6al Firmware
CWEs
- CWE-330
References
Raw JSON (NVD)
Show
{
"id": "CVE-2020-9502",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@dahuatech.com",
"affectedData": [
{
"vendor": "n/a",
"product": "IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HFW1431S",
"versions": [
{
"status": "affected",
"version": "Versions which Build time before December,2019"
}
]
}
]
}
],
"published": "2020-05-13T16:15:13.277",
"references": [
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/777",
"tags": [
"Vendor Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/777",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-330"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device."
},
{
"lang": "es",
"value": "Algunos productos Dahua con tiempo de Compilación antes de diciembre de 2019 presentan vulnerabilidades predecibles del ID de Sesión. Durante un acceso de usuario normal, un atacante puede usar el ID de Sesión previsto para construir un paquete de datos para atacar el dispositivo."
}
],
"lastModified": "2026-06-17T03:28:04.937",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1CE773D-CA5F-483C-B20C-DAD30A590DDD",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:sd6al:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C35F4371-334B-4EA8-8F48-498C81652F7C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:sd5a_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "083AE420-CAF9-4A2A-8C76-79DD590FA191",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:sd5a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1EE24474-EF35-4475-99DD-4B54D6AF0B2D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:sd1a_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A075994-60D1-40B7-9EF6-8048CBC18764",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:sd1a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7A3C5893-E1D0-4E06-9F7F-058B657E4493"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ptz1a_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F78D2E9E-9909-4130-A146-CA861F7DF341",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ptz1a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19B57B9D-0729-48E0-892B-E39AE1F89AB4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18CD222C-C95A-4D5E-A763-5D2F74EAEC04",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:sd50:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "984AD4D5-D689-4150-A1EE-D48B81CBB7C8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0ECBC0BF-171E-49FD-B6AF-CC7B29D39FB7",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:sd52c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5BA0D206-5BE7-4592-8D3E-641F47164770"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx5842h_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E8CB654-0526-4E7A-8984-8350B39BB4DF",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx5842h:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "724F4B7D-C8C1-4914-B1D6-B4CB9B1F4093"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx7842h_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AEBFC1D-9F25-4FDB-A191-D7D6C1C6E234",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx7842h:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5D6E27D8-C608-49E7-8284-5196EDB428DB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx2xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A046C7EA-F954-4F36-9ED3-DBA84F1FB2D3",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx2xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5B8887C8-C335-4EBB-BC7F-D4F8D8205DAE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hxxx5x4x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DCD8DCD2-5CEA-420F-860C-11B469D9FF8F",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hxxx5x4x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F051A1A0-E841-42E7-92A3-E45E4017DCDE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n42b1p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F092AA97-7184-4499-BB83-D6204BD4621B",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n42b1p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FCB3A7FD-63A2-423C-912F-E2E5B4690CF1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n42b2p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "855B3C5F-CE9D-4FFA-B485-11A8D675F006",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n42b2p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "83B0FAFA-BEF4-4196-A4BC-4CFD6DCF4986"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n42b3p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D0E03DE-1BFA-43AD-9AC6-72A1A1545D4B",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n42b3p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B51E9FED-4929-42CC-AA6F-BFF61E8F88C0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n52a4p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F20B6467-53DC-4DC6-BCC2-6B6B33ABD65D",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n52a4p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EB41CE1D-1A97-4549-A849-D06F78858CA3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n54a4p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFA91720-5AE4-48B6-A940-A4DBE650591D",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n54a4p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D479D171-7F30-4D6B-8A49-0A3967103B94"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n52b2p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACD4FD87-1D74-4895-AA89-D26541A55433",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n52b2p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7936F0A3-F6DF-47B2-898E-DBE68B369633"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n52b5p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D5136C6-2355-4782-BF9C-0874DC5B0CDA",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n52b5p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "195D7533-B2EF-4BC2-B6D6-0B141FB90090"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n52b3p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7180D6E1-6F7F-4EAD-BD51-02C029EFB034",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n52b3p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "03D1AD58-447D-4D30-B9CF-48B5CB743C2B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:n54b2p_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEC0287A-824B-46D0-84AB-54BEEF90E16B",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:n54b2p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5667962D-1A47-4D77-95A4-6B34F8863761"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hdbw1320e-w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CBF6051-B1DF-4028-ADC1-CF3820C1CA71",
"versionEndExcluding": "2019-12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hdbw1320e-w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F221BD07-E754-4355-B031-A95147905815"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@dahuatech.com"
}