TI-2025-43987 Aliases CVE-2025-31704 GHSA-9248-6x5c-955r

Command injection in Dahua Intelligent Connection Center

MEDIUM 52CWE-78Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Dahua Intelligent Connection Center versions from V1.000.0000000.1 through 1.000.0000005.0 and from V5.000.0000000.6 before V5.000.0000000.15 are affected. Improper neutralization of special elements used in an OS command (CWE-78) lets crafted input reach system commands. A remote unauthenticated attacker can send a specially crafted request to execute arbitrary commands and achieve remote code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01364 71st percentileScored 2026-11-07

Fix Fixed Intelligent Connection Center (Dahua): V5.000.0000000.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dahua	Intelligent Connection Center	V1.000.0000000.1 – 1.000.0000005.0; V5.000.0000000.6 to before V5.000.0000000.15	V5.000.0000000.15	Patch available	CNA

Intelligent Connection Center VendorDahua Affected V1.000.0000000.1 – 1.000.0000005.0; V5.000.0000000.6 to before V5.000.0000000.15 Fixed in V5.000.0000000.15 Patch available CNA

Remediation

Upgrade Dahua Intelligent Connection Center to V5.000.0000000.15 or later. The sources list no fixed version for the range starting at V1.000.0000000.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA Intelligent Connection Center (Dahua) Fixed in V5.000.0000000.15

Timeline

2026-10-30 Threatist record created from CVE-2025-31704
2026-10-30 Alias added: GHSA-9248-6x5c-955r
2026-10-30 CISA SSVC decision points changed

References

Advisory 1

https://www.cnvd.org.cn/flaw/show/CNVD-2025-00420

TI-2021-12646 Improper authentication in Some Dahua IP Camera, Video Intercom, NVR, XVR devices KEVCVSS 3.1CRITICAL 9.8
TI-2021-12645 Improper authentication in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal… KEVCVSS 3.1CRITICAL 9.8
TI-2023-03585 Dahua Smart Park Management unrestricted upload CVSS 3.1CRITICAL 9.8
TI-2024-12178 Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal CVSS 4.0MEDIUM 5.3
TI-2019-02954 Missing authentication in Dahua IPC-XXBXX CVSS 3.0HIGH 7.5
TI-2017-02426 Stack-based buffer overflow in Dahua IP Camera CVSS 3.0CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences