CVE-2026-29114 is a vulnerability in Dahua IPC products where an attacker may access the device’s CA root certificate due to improper handling of sensitive information (CWE-538). This exposure could allow the attacker to create fraudulent certificates trusted by clients that have the CA installed, compromising the certificate trust chain. The vulnerability has a low CVSS score (2.3) and no known exploits in the wild. No vendor advisory or patch information is provided, and the remediation level is not specified.

An attacker who obtains the CA root certificate from the affected Dahua IPC device could issue fraudulent certificates that client systems trusting this CA would accept. This undermines the trust model of certificates, potentially enabling man-in-the-middle attacks or impersonation if clients have installed and trust the compromised CA. However, the overall impact is limited by the requirement that the CA be installed and trusted on client systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should carefully manage and verify trusted CA certificates on client systems and avoid installing untrusted or unnecessary CA certificates from these devices.