{"id":"CVE-2025-31704","aliases":[],"cve":{"records":[{"id":"CVE-2025-31704","source":"dahua","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-04-01T05:57:11.783Z","published":"2026-10-30T10:25:46.561Z","modified":"2026-10-30T15:07:34.049Z"}],"publishers":[{"name":"dahua","role":"CNA","organizationId":"79ee569e-7d1e-4364-98f0-3a18e2a739ad","modified":"2026-10-30T10:25:46.561Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T15:07:34.049Z"}],"references":[{"url":"https://www.cnvd.org.cn/flaw/show/CNVD-2025-00420","tags":["third-party-advisory"],"source":"dahua"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","source":"dahua"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T14:56:03.867102Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Dahua Intelligent Connection Center command injection","titleSource":"dahua","descriptionSource":"dahua","description":"A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.","score":9.8,"severity":"critical","published":"2026-10-30T10:25:46.561Z","modified":"2026-10-30T15:07:34.049Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Dahua","name":"Intelligent Connection Center","platforms":[],"versions":[{"version":"V1.000.0000000.1","status":"affected","lessThanOrEqual":"1.000.0000005.0","versionType":"custom"},{"version":"V5.000.0000000.6","status":"affected","lessThan":"V5.000.0000000.15","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"dahua","url":"https://www.cve.org/CVERecord?id=CVE-2025-31704"}],"remediation":[],"references":["https://www.cnvd.org.cn/flaw/show/CNVD-2025-00420"],"sources":[{"name":"CVE","id":"CVE-2025-31704","modified":"2026-10-30T15:07:34.049Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-31704"}],"assessments":[{"source":"dahua","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-10-30T16:39:50.624Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T10:40:31.474Z","attemptedAt":"2026-10-30T10:40:31.474Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T10:40:31.472Z","attemptedAt":"2026-10-30T10:40:31.472Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T10:40:30.906Z","attemptedAt":"2026-10-30T10:40:30.906Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:40:31.474Z","attemptedAt":"2026-10-30T10:40:31.474Z"}],"evidence":[],"aiSummary":{"text":"A vulnerability in Dahua Intelligent Connection Center versions V1.000.0000000.1 to V1.000.0000005.0 and V5.000.0000000.6 to V5.000.0000000.15 may allow a remote attacker to execute arbitrary commands. The weakness is due to improper neutralization of special elements used in an OS command. This may result in remote code execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:36:02.263Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2025-31704"}]}}