The vulnerability is classified as CWE‑617, which involves input that can trigger an exception when processed. An unauthenticated attacker can send a specially crafted packet over the network, causing the system to reboot unexpectedly. This loss of availability interrupts surveillance and security functions, as the device requires a full reboot to recover.

This flaw affects a range of Dahua products, including IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC models. The affected devices are part of Dahua’s surveillance product line; specific firmware or hardware versions are not listed, but the advisory notes that several models are impacted.

The CVSS score of 8.7 classifies this vulnerability as high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote attacker who can send the crafted packet over the network. If successful, the device will reboot immediately, disrupting services until the device recovers. The absence of authentication or input validation allows the exploitation without privileged access.