External risk intelligence

Dahua Intelligent Connection Center Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-31704

The Dahua Intelligent Connection Center is a centralized management system typically deployed as a network-facing appliance or server to manage distributed security infrastructure. Such systems are commonly exposed to the network or the internet to facilitate remote monitoring and control of connected devices, making them accessible service endpoints.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Dahua Intelligent Connection Center, a system used for centralized management of security infrastructure. This issue allows remote attackers to execute arbitrary commands on the affected system, potentially leading to unauthorized control. The main concern is confirming relevance and exposure due to the system's typical network-facing deployment.

Attackers can run any command remotely.
Centralized security systems are often network-exposed.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker could target the Dahua Intelligent Connection Center from the internet by sending a malicious request to the system. This could allow them to execute commands remotely.

Exposed to the network.
Specially crafted request sent.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the Dahua Intelligent Connection Center could allow a remote attacker to execute arbitrary commands. This could occur when a specially crafted request is sent to the affected system, potentially leading to a complete compromise of the server.

System commands could be executed remotely.
Exposure may happen via crafted network requests.
Potential for unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dahua Intelligent Connection Center's critical remote code execution vulnerability necessitates immediate action from teams responsible for network-facing security appliances and centralized management systems. The first practical step is to locate all instances of the Dahua Intelligent Connection Center within your environment, determine their network exposure and business criticality, and identify the accountable system owner. Following this, a risk-based remediation plan, potentially involving vendor coordination or targeted patching during a planned maintenance window, should be developed.

Identify and secure Dahua Intelligent Connection Center instances.
Verify network exposure and business criticality.
Plan targeted remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dahua Intelligent Connection Center?

The Dahua Intelligent Connection Center is a centralized management platform designed to oversee distributed security infrastructure. It functions as a core server or appliance that enables administrators to remotely monitor and control connected security devices from a single point within a network environment.

What does CWE-78 mean for CVE-2025-31704?

CWE-78 refers to Improper Neutralization of Special Elements used in an OS Command. In the context of this vulnerability, it means the software fails to properly filter or sanitize user input before passing it to the operating system, allowing an attacker to inject and execute their own unauthorized commands on the server.

How can an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending a specially crafted request to the system over the network. It is important to note that this flaw does not require the attacker to have prior authentication or access to the system; the vulnerability resides in how the software processes these incoming malicious requests.

Is my system at risk if it is not internet-facing?

Halo Surface Signal indicates that this system is typically deployed as a network-facing appliance to manage security infrastructure. While internet-facing instances are at the highest risk, any system reachable over your internal network can be targeted by an attacker who has gained a foothold in your environment.

What are the first steps to address this CVE?

Start by identifying all instances of the Dahua Intelligent Connection Center in your network. Determine which systems are exposed, identify the business owners for those assets, and assess their criticality. Once mapped, coordinate with your team to plan for remediation or patching according to your maintenance policies.

References

www.cnvd.org.cn/flaw/show/CNVD-2025-00420

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.