CVE-2017-7925: Dahua cameras and recorders store privileged passwords in configuration files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 3.0 score is 9.8 with network reachability, no authentication and no user interaction, and the flaw exposes privileged credentials.

What it is

Dahua IP cameras, NVRs and HCVRs store credentials in configuration files in an insufficiently protected form (CWE-260/CWE-522). An attacker who obtains a configuration file can recover a privileged account password and use it to access the device and its sensitive data. The flaw affects a broad range of DH-IPC, DH-SD6CXX, DH-NVR1XXX and DH-HCVR product families.

Impact

An attacker gains the credentials of a privileged user, allowing them to assume that identity and reach sensitive information and device functionality. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the configuration file can be reached over the network without authentication. The description does not state the exact retrieval path, so the precise interface is not documented in this record.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is high (0.51418, 98.9th percentile), and references include vendor patch and ICS-CERT advisory material, but no public exploit is confirmed by the supplied tags.

What to do

• Apply the Dahua security bulletin patch for the affected camera, NVR and HCVR models.
• Follow the ICS-CERT advisory ICSA-17-124-02 mitigations, including isolating affected devices on segmented networks.
• Change default and privileged credentials and avoid reusing them across devices.
• Restrict network access to device management interfaces and configuration endpoints.
• Monitor for unauthorized retrieval of configuration files or credential material.

Detection

• Alert on access to device configuration or backup endpoints from unexpected hosts.
• Monitor authentication logs for privileged logins from new or unusual source addresses.
• Watch for configuration file downloads or exports outside normal administrative workflows.
• Baseline device firmware versions and flag units that have not received the vendor patch.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.