External risk intelligence

Dahua EIMS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2024-13985

The vulnerability affects Dahua EIMS, a platform typically deployed as an internet-facing gateway or management service for surveillance systems. Because it allows unauthenticated command injection via HTTP requests, it is designed to be accessible across a network, often leading to public-facing exposure in common deployment scenarios.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical command injection vulnerability within Dahua EIMS. The flaw allows unauthenticated remote attackers to execute arbitrary system commands, potentially leading to full system compromise. The primary concern is confirming relevance and exposure given the nature of the affected technology.

Unauthenticated attackers can run commands remotely.
Critical flaw enables full system compromise.
Confirm relevance and exposure for Dahua EIMS.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a vulnerable Dahua EIMS system. This bypasses the need for any authentication and directly targets an interface designed to handle commands. The vulnerability occurs because the system does not properly check or clean the input provided for the `captureCommand` parameter. Successful exploitation allows the attacker to execute arbitrary operating system commands on the server, potentially leading to a complete compromise of the system.

No authentication required to access.
Unsanitized command input triggers vulnerability.
Arbitrary command execution leads to compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on affected systems. This could occur when the `capture_handle.action` interface is accessed and improperly validated input is provided in the `captureCommand` parameter. The consequence could be full system compromise.

System commands may be executed.
Crafted HTTP requests could trigger execution.
Full system compromise is a risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and security teams are likely responsible for addressing this critical command injection vulnerability in Dahua EIMS. The first practical move is to identify all instances of the affected technology, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Infrastructure or security teams should own the issue.
Verify network exposure and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dahua EIMS?

Dahua EIMS is an enterprise-grade platform used to manage and integrate various components within video surveillance and security ecosystems. It often functions as a centralized gateway or management service, coordinating data flow and system operations across the security infrastructure.

What does command injection mean for CVE-2024-13985?

This vulnerability, classified as CWE-78, occurs when software fails to properly sanitize user-supplied input before passing it to a system shell. In this case, the application blindly executes commands provided in the 'captureCommand' parameter. By supplying crafted data, an attacker can trick the server into running unintended operating system commands with the application's own privileges.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted HTTP request to the 'capture_handle.action' interface on the EIMS server. The vulnerability requires no prior authentication, meaning a remote actor does not need valid user credentials to interact with the target. Simply navigating to the management interface without malicious parameters does not trigger the execution; the payload must specifically target the unsanitized parameter.

Is my system at risk?

Halo Surface Signal indicates that Dahua EIMS is frequently deployed as an internet-facing service to facilitate remote management of surveillance assets. If your instance is reachable over the internet rather than restricted to a private, internal-only network, the risk of external exploitation is significantly higher, warranting immediate attention.

What should I do if I run this software?

First, conduct an inventory to locate all EIMS instances within your environment and determine which are internet-facing. Review vendor documentation for authorized updates or configuration guidance to address the lack of input sanitization. Assign responsibility to your security or infrastructure teams to track these assets, assess their specific risk, and manage the deployment of necessary patches or security mitigations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.