A flaw in Dahua IPC cameras allows extraction of the device’s CA root certificate. If an attacker obtains this certificate and installs it in a client system’s trust store, certificates signed by that CA will be treated as legitimate, effectively compromising the certificate trust chain. The weakness is a certificate disclosure flaw, classified under CWE‑538.

The advisory mentions Dahua IPC cameras. No specific firmware versions are identified, so users should verify whether their cameras belong to the affected line and consult the vendor for any patch or firmware update.

The CVSS score of 2.3 indicates low overall impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to first extract the CA certificate from the device; once this certificate is trusted by a client, an attacker could sign certificates that the client would accept. While no public exploit has been reported, any environment that automatically trusts certificates from Dahua devices is potentially at risk until a vendor fix is released.