Dahua · Dahua Eims · CVE-2024-13985
Name of the Vulnerable Software and Affected Versions:
Dahua EIMS versions prior to 2240008
Description:
A command injection flaw in Dahua EIMS allows unauthenticated remote attackers to execute arbitrary system commands. This is due to improper input validation in the `captureCommand` parameter of the `/capture handle.action` API endpoint. Crafted HTTP requests can inject OS-level commands, potentially leading to full system compromise.
Recommendations:
Update Dahua EIMS to version 2240008 or later.
As a temporary workaround, restrict access to the `/capture handle.action` API endpoint.
Sanitize all input to the `captureCommand` parameter.