Dahua Intelligent Connection Center: OS command injection allows remote code execution
Summary
The Dahua Intelligent Connection Center contains a command injection flaw (CWE-78) that can be triggered by a specially crafted network request. According to the CVSS vector, no authentication or user interaction is required, and an attacker could execute arbitrary commands with high impact on confidentiality, integrity and availability. Version data is provisional because the vendor advisory could not be located and NVD analysis was still pending at publication.
Affected
- Dahua Intelligent Connection Center V1.000.0000000.1 to 1.000.0000005.0 (vendor status for fixes unconfirmed)
- Dahua Intelligent Connection Center V5.000.0000000.6 before 5.000.0000000.15
- Default configuration: unaffected (according to the CNA record, the exact default is not further detailed)
Fixed in
- V5.x: fixed in 5.000.0000000.15 (per OffSeq and VulDB; confirm with Dahua)
- V1.x: Unknown. No fixed build found in any source.
Workaround
- No vendor workaround found.
- Isolate the system on a restricted network segment and remove direct internet exposure until a fix is confirmed.
- Monitor access logs for unusual request patterns.
Exploitation
- CISA KEV: not listed.
- OffSeq: not known to be exploited.
- No public proof-of-concept found; VulDB states no exploit is available.
- Exploitation status: unconfirmed.
Our recommendation
- Check whether the product is installed, including instances run by integrators.
- Identify the exact build number; upgrade 5.x builds to 5.000.0000000.15 or later.
- For 1.x builds, contact Dahua to confirm the fix status before relying on them.
- Remove internet exposure and restrict access to management networks.
- Monitor logs and re-check the Dahua PSIRT page and NVD once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CNVD-2025-00420 www.cnvd.org.cn
- VulDB entry 428979 vuldb.com
- OffSeq threat radar radar.offseq.com
- Strix CVE page www.strix.ai
- ThreatInt CVE record cve.threatint.com
- TheHackerWire advisory www.thehackerwire.com
- TheHackerWire vulnerability page www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:46.
Original description (NVD)
A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.