Executive Summary
CVE-2025-31704 is a critical command injection vulnerability in the Dahua Intelligent Connection Center. A remote attacker can send a specially crafted request to the affected system and execute arbitrary commands, resulting in remote code execution (RCE). No authentication and no user interaction are required.
The CVE was reserved in April 2025 and was published in the NVD on October 30, 2026. Dahua's advisory is tracked as CNVD-2025-00420.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2025-31704 |
| CVSS v3.1 Score | 9.8 (Critical) (as scored by the CNA) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Weakness | CWE-78 — OS Command Injection |
| Vendor Advisory ID | CNVD-2025-00420 |
| NVD Published | October 30, 2026 |
Note: Some third-party databases classify the weakness as CWE-94 (code injection) and list a different base score. The vendor-assigned 9.8 is used here.
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Dahua Intelligent Connection Center (1.x branch) | 1.000.0000000.1 through 1.000.0000005.0 | Move to the 5.x branch |
| Dahua Intelligent Connection Center (5.x branch) | 5.000.0000000.6 up to, but not including, 5.000.0000000.15 | V5.000.0000000.15 |
Technical Analysis
The flaw is an OS command injection in a request handler of the Intelligent Connection Center. Input from a network request is passed into a command context without adequate validation, so shell metacharacters or command syntax supplied by an attacker are executed on the underlying host.
Public technical detail is limited. At the time of writing, no vendor write-up or proof-of-concept walkthrough describes the exact vulnerable endpoint.
Exploitation Status
Reporting on exploitation is inconsistent:
- Some trackers report the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and that no public PoC has been observed.
- Other aggregators reference a VulnCheck KEV entry and honeypot activity.
Treat the flaw as likely to be exploited given its pre-authentication, low-complexity profile, and verify KEV status directly before deciding on urgency.
Impact
Successful exploitation can give an attacker:
- Arbitrary command execution on the Intelligent Connection Center host
- Control of the management platform that connects Dahua devices
- A foothold for lateral movement into camera, recorder, and corporate networks
- Access to device credentials and configuration stored on the platform
Remediation
- Upgrade the Intelligent Connection Center to V5.000.0000000.15 or later
- Remove internet exposure — the service should never be reachable from the public internet
- Segment the service into a dedicated VLAN, with access limited to trusted internal hosts
- Monitor access logs for anomalous requests, especially unusual characters or command-line syntax in parameters
- Review the host for unexpected processes, new accounts, and outbound connections
Lockdown Checklist
- Identify all Intelligent Connection Center instances, including shadow deployments
- Confirm installed version against the affected ranges above
- Apply the fixed release
- Restrict inbound access with firewall rules or ACLs
- Rotate credentials stored on or used by the platform if compromise is suspected
Key Takeaways
- Critical pre-auth RCE with CVSS 9.8 in Dahua's device management platform
- Fixed in V5.000.0000000.15 — the 1.x branch has no listed fixed release, so plan a migration
- Exploitation status is unclear across sources — verify against KEV and your own telemetry
- Network segmentation is the strongest compensating control for surveillance management platforms