EUVD-2025-211216
GHSA-9248-6x5c-955r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ICC service over network
-
DeliverySend crafted request with injected command
-
ExploitTrigger OS command injection (CWE-78)
-
ExecutionExecute arbitrary commands on host
-
ImpactFull compromise of system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are indicated - the CVSS vector is fully default-exposure (AV:N/AC:L/PR:N/UI:N), implying remote unauthenticated exploitation against a reachable Dahua Intelligent Connection Center instance. The only practical prerequisite is network reachability of the ICC service; the exact command-injection trigger (which parameter or endpoint accepts the crafted request) is not described in the available sources. The primary limiting factor is network exposure: instances isolated from untrusted networks or placed behind access controls substantially reduce reachability, since authentication (PR:N) imposes no barrier. |
| Impact | All available signals converge on high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable flaw requiring no privileges and no user interaction, with high confidentiality, integrity, and availability impact (9.8). The CWE-78 classification and the RCE/Command Injection tags indicate OS command injection leading to remote code execution, which is consistent with the unauthenticated-network profile. The vuln.today Decision label is act_now, reinforcing that this should be remediated immediately rather than deferred. Countervailing data is simply absent rather than conflicting: there is no EPSS score provided, the CVE is not indicated as present in CISA KEV, and no proof-of-concept or working exploit is referenced. The single reference is a CNVD advisory entry, not an exploit. So the urgency rests on the severity profile and the act_now decision label rather than on confirmed exploitation - the exploitation-probability and in-the-wild signals are unknown from the supplied data and should not be assumed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Dahua Intelligent Connection Center over the network sends a specially crafted request that injects operating-system commands, achieving arbitrary command execution on the host. Because no authentication or user interaction is required, the attack can be fully remote against an exposed instance. No public exploit is identified in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Remote unauthenticated command injection in Dahua Intelligent Connection Center allows network-reachable attackers to execute arbitrary commands with high confidentiality, integrity, and availability impact (CVSS 9.8). The supplied CPE has no version restriction, so all versions of the product family should be considered potentially affected until Dahua confirms fixed releases; the trigger endpoint or parameter is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry was provided, but the vuln.today decision label is act_now.
RemediationAI
No fixed version or vendor patch is listed in the supplied data; obtain the current Dahua advisory and the CNVD-2025-00420 record and apply the vendor-designated fixed release when it is identified. Because network reachability is the practical prerequisite for this unauthenticated remote flaw, reduce exposure in the interim by restricting access to the Intelligent Connection Center service to trusted management networks and blocking untrusted network paths; this lowers reachability but does not remediate the command-injection flaw, and no specific port, endpoint, or feature-level workaround is provided in the sources. Restricting access can interrupt legitimate remote administration and integrations, so scope allow-lists to required management sources. The vuln.today decision label is act_now, so treat exposure review and vendor patch confirmation as urgent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-78 OS command injection in Dahua Intelligent Connection Center, reachable over the network with no authentication or user interaction per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-78 identifies the root-cause class as insufficient neutralization of input used in OS command construction, which can let crafted requests alter command execution; the exact endpoint, parameter, and injection syntax are not described in the supplied sources. The CPE cpe:2.3:a:dahua:intelligent_connection_center:*:*:*:*:*:*:*:* identifies the product family without a version boundary, and the supplied reference is the CNVD entry CNVD-2025-00420.
Know when Intelligent Connection Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated OS command injection (CWE-78) with no user interaction yields AV:N/AC:L/PR:N/UI:N, and resulting RCE gives full C/I/A impact.
Primary rating from Vendor (dahua).
CVSS VectorVendor: dahua
DescriptionCVE.org
A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
Technical POC Analysis
The assigned weakness is CWE-78: OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Dahua Intelligent Connection Center, a critical network management platform, contains a remotely exploitable command injection flaw that allows unauthenticated attackers to fully compromise the system. Successful exploitation could lead to unauthorized access to sensitive data, disruption of building security operations, and potential lateral movement within the network. Leadership should prioritize immediate assessment and mitigation because this vulnerability poses a severe risk to organizational assets and safety.
No vendor-released patch identified at time of analysis. Implement network segmentation to isolate the product from untrusted networks, restrict access to trusted IP ranges, deploy virtual patching via WAF/IPS, monitor for suspicious activity, and consider temporary decommissioning until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB