CVE-2019-9682 [High] | Security Vulnerability in Sd6al Firmware

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.41%	0.86%	+0.45%
2	2025-03-30	0.79%	0.41%	-0.38%
3	2025-03-29	—	0.79%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.41%

0.86%

+0.45%

2025-03-30

0.79%

0.41%

-0.38%

2025-03-29

—

0.79%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.1	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.2	5.9	[email protected]
6.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.6	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.1

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.2

5.9

[email protected]

6.8

2.0

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

8.6

6.4

[email protected]

Affected software / configurations for CVE-2019-9682

Vendor	Product	Version	Raw CPE
dahuasecurity	sd6al_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:sd6al_firmware::::::::
dahuasecurity	sd5a_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:sd5a_firmware::::::::
dahuasecurity	sd1a_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:sd1a_firmware::::::::
dahuasecurity	ptz1a_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ptz1a_firmware::::::::
dahuasecurity	sd50_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:sd50_firmware::::::::
dahuasecurity	sd52c_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:sd52c_firmware::::::::
dahuasecurity	ipc-hx5842h_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ipc-hx5842h_firmware::::::::
dahuasecurity	ipc-hx7842h_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ipc-hx7842h_firmware::::::::
dahuasecurity	ipc-hx2xxx_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ipc-hx2xxx_firmware::::::::
dahuasecurity	ipc-hxxx5x4x_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ipc-hxxx5x4x_firmware::::::::
dahuasecurity	n42b1p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n42b1p_firmware::::::::
dahuasecurity	n42b2p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n42b2p_firmware::::::::
dahuasecurity	n42b3p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n42b3p_firmware::::::::
dahuasecurity	n52a4p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n52a4p_firmware::::::::
dahuasecurity	n54a4p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n54a4p_firmware::::::::
dahuasecurity	n52b2p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n52b2p_firmware::::::::
dahuasecurity	n52b5p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n52b5p_firmware::::::::
dahuasecurity	n52b3p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n52b3p_firmware::::::::
dahuasecurity	n54b2p_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:n54b2p_firmware::::::::
dahuasecurity	ipc-hdbw1320e-w_firmware	< 2019-12	cpe:2.3:o:dahuasecurity:ipc-hdbw1320e-w_firmware::::::::

References for CVE-2019-9682

URL	Tags
https://www.dahuasecurity.com/support/cybersecurity/details/767	Vendor Advisory

URL

CVE-2019-9682

Exploit prediction scoring system (EPSS) score for CVE-2019-9682

Common vulnerability scoring system (CVSS) metrics for CVE-2019-9682

Weakness enumeration for CVE-2019-9682

Affected software / configurations for CVE-2019-9682

References for CVE-2019-9682