CVE-2025-31704 PUBLISHED

Dahua Intelligent Connection Center command injection

Assigner: dahua
Reserved: 01.04.2025 Published: 30.10.2026 Updated: 30.10.2026

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Dahua
Product Intelligent Connection Center
Versions Default: unaffected
  • affected from V1.000.0000000.1 to 1.000.0000005.0 (incl.)
  • affected from V5.000.0000000.6 to V5.000.0000000.15 (excl.)

References

Problem Types

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

  • CAPEC-116 Excavation