Information disclosure in Dahua Ipc

CVE-2026-29114

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and undermine the certificate trust chain.

Published · last modified .

EPSS exploit prediction

EPSS: 0.003 (17.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 17.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-29114: held from 0.002 to 0.003.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

  • Dahua Ipc — versions Some IPC models are affected, specifically those with a build date before April 15, 2026.

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2026-29114?
CVE-2026-29114 is a vulnerability in Dahua Ipc, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. Published 2026-06-10.
Is CVE-2026-29114 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.