Zhejiang Dahua Technology vulnerabilities
We track 3 vulnerabilities in Zhejiang Dahua Technology products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2025.
Latest Zhejiang Dahua Technology vulnerabilities
- 10.0 Critical severity
EIMS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand
- 10.0 Critical severity
Smart Park Integrated Management Platform: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remo
- 8.7 High severity
Smart Cloud Gateway Registration Management…: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attacker