Security Technologies

Safety-Related Documents

Security Advisories
Security Notices

Go to Page

Report a vulnerability

We encourage users, partners, suppliers, security organizations and independent researchers to actively report to Dahua PSIRT by email any security risks or vulnerabilities related to Dahua products and solutions. Due to the sesitivity of vulnerability information, we recommended to use our PGP public key (Key ID: 0xC6068E4B; PGP Fingerprint: 61769A82F67E062CA46C19A6DEA2F8C6068E4B) and report it to psirt@dahuatech.com. In order to facilitate timely verification and location of vulnerabilities, the content of the email should include the following:

1. Organization/Title and Contact Information
2. Description of potential security risks/vulnerabilities
3. Technical details (e.g. system configuration, positioning method, description/screenshot of exploit, sample captured images, POC, steps to reproduce problems, etc.)
4. Report the product name, model and software/firmware version where the security risks/vulnerabilities are located.
5. Possible vulnerability disclosure plan

How we deal with vulnerabilities

Dahua PSIRT will strictly control the scope of vulnerability information and limit it to the relevant personnel who only deal with vulnerabilities; At the same time, the vulnerability reporter is also required to keep this vulnerability confidential until it is publicly disclosed.

Dahua PSIRT discloses security vulnerabilities in the following two forms:

1. SA (Security Advisory): for the release of information about security vulnerabilities related to Dahua products and solutions, including but not limited to vulnerability descriptions, fixes, etc.
2. SN (Security Notice): for the responses to security topics related to Dahua products and solutions, including but not limited to vulnerabilities and security incidents.

Dahua PSIRT adopts CVSSv3 standards, and gives a Base Score and a Temporal Score for each security vulnerability assessment. Customers can also make their own Environmental Score according to their needs.
For specific CVSSv3 standards, visit this link: https://www.first.org/cvss/specification-document

Our responses to vulnerabilitie

Receive

Receive and collect suspected security vulnerabilities of products

Verify

Coordinate with relevant teams to conduct vulnerability verification and risk rating

Repair

Analyze the cause of vulnerability and implement the vulnerability repair

Disclose

Actively disclose vulnerability information and release fixed firmware

Improve

Improve vulnerability scanning capability and transform to product security requirements

Region/Language

Home

Business

Software

For Business

For Consumer

City Solutions

Enterprise Solutions

SMB Solutions by Applications

SMB Solutions by Scenarios

Training

Service & Support

ECO Partner Community

Developer Community

Brand Introduction

News & Events

Trust Center

Ethic And Complince

Sustainability

Security Technologies

Dahua Partner APP

Please select your question