CVE-2024-13985: Dahua EIMS capture_handle.action RCE
A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capturehandle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13985?
CVE-2024-13985 is classified as a critical vulnerability due to its potential for unauthenticated remote command execution.
How do I fix CVE-2024-13985?
To remediate CVE-2024-13985, update Dahua EIMS to version 2240008 or later to ensure proper input validation.
What are the implications of CVE-2024-13985?
Exploitation of CVE-2024-13985 allows attackers to execute arbitrary commands on the underlying system, potentially leading to full system compromise.
Which versions of Dahua EIMS are affected by CVE-2024-13985?
CVE-2024-13985 affects all Dahua EIMS versions prior to 2240008.
Is authentication required to exploit CVE-2024-13985?
No, CVE-2024-13985 can be exploited by unauthenticated remote attackers.