CVE-2026-29114 is a CWE-538 vulnerability in certain Dahua IPC devices that results in the insertion of sensitive information—specifically the device's CA root certificate—into an externally accessible file or directory. This exposure allows an attacker to obtain the CA root certificate. If client systems have this CA installed and trusted, the attacker could issue fraudulent certificates that these clients would trust, thereby compromising the certificate trust chain. The vulnerability affects IPC models built before April 15, 2026. There is no vendor advisory or patch available at this time.

An attacker who obtains the device's CA root certificate can issue fraudulent certificates trusted by client systems that have the CA installed. This undermines the trust model of certificates and could facilitate man-in-the-middle or impersonation attacks against clients trusting this CA. However, the overall severity is low, and no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the device's file system and avoid installing the device's CA root certificate on client systems unless absolutely necessary.