External risk intelligence

Dahua Smart Park Platform Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2023-7309

The vulnerability affects an integrated management platform's web-based interface, which is designed for remote access and management. The flaw exists in a SOAP-based file upload interface that is reachable without authentication, making the service inherently internet-facing in its typical deployment as a centralized management platform.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the Dahua Smart Park Integrated Management Platform, specifically within its file upload feature. This issue could potentially allow unauthorized remote access and full system compromise if exploited. The primary concern is to determine if this platform is in use and exposed to potential threats.

Upload vulnerability could allow system takeover.
Confirm if this management platform is in use.
Understand potential exposure and confirm relevance.

Attack Path

How an attacker could exploit the issue

Attackers can remotely target the Dahua Smart Park Integrated Management Platform by sending specially crafted requests to its file upload interface. This interface, which uses SOAP for communication, is exposed and does not require authentication, allowing attackers to upload arbitrary files. If successful, this can lead to the execution of malicious code and complete control of the system.

No authentication needed to reach the server.
Send malicious files via a SOAP request.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in the Dahua Smart Park Integrated Management Platform's GIS bitmap upload interface could allow unauthenticated attackers to upload arbitrary files, including executable payloads, to the server. This exposure could lead to remote code execution and full system compromise when the platform is deployed with this interface accessible.

System files could be overwritten or replaced.
Arbitrary files can be uploaded via the interface.
Remote code execution and system compromise are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and system owners should focus on identifying and isolating instances of the Dahua Smart Park Integrated Management Platform. The first practical step involves locating all deployments, determining their exposure and criticality, assigning ownership, and then prioritizing remediation efforts.

Identify affected system owners.
Verify external reachability and business criticality.
Plan remediation based on asset risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dahua Smart Park Integrated Management Platform?

This software, also known as the Dahua Smart Campus Integrated Management Platform, serves as a centralized control center for managing smart park operations and security infrastructure. It integrates various management functions into a single web-based interface, which is typically deployed to monitor and control physical assets across a campus environment.

What does CVE-2023-7309 mean in simple terms?

This vulnerability is classified as a path traversal and unrestricted file upload issue. It occurs because the platform's GIS bitmap upload interface fails to properly validate files. An attacker can exploit this weakness to bypass security checks and place malicious files, such as executable scripts, onto the server, potentially gaining full control over the underlying system.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted SOAP request to the platform's GIS bitmap upload interface. Because this specific interface does not require authentication, the attacker does not need a username or password to initiate the process. Requests that do not conform to the expected SOAP format or are directed toward secure, non-GIS interfaces will not trigger this specific vulnerability.

Is my system at risk for this CVE?

According to Halo Surface Signal, this vulnerability is very likely to pose a risk to internet-facing deployments. Because the management platform is designed for remote administration, it is often exposed to the network. If your instance is reachable from the internet, it is a higher priority for review than internal-only systems, as the flaw is reachable without authentication.

What should I do if I run this Dahua software?

Your first step is to locate all active deployments of the Dahua Smart Park Integrated Management Platform within your environment. Verify whether these instances are accessible from the internet and assess their business criticality. Once identified, ensure you are running the latest version provided by the vendor, as older builds—specifically those released prior to September 2023—are known to be affected by this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.