CVE-2024-13985 — Dahua EIMS capture_handle.action Remote Code Execution

Advisory type: Vendor-coordinated security disclosure · Active exploitation reported
CVE ID: CVE-2024-13985
CNVD ID: CNVD-2024-17054
Vendor: Zhejiang Dahua Technology Co., Ltd.
Product: EIMS (Enterprise Information Management System)
Published: 2025-08-27T21:23:37 UTC
Last Modified: 2026-05-15T11:14:33 UTC
Source: Dahua Support Bulletin

Table of Contents

• Executive Summary
• At a Glance
• Relationship to Other Dahua CVEs
• Vulnerability Timeline
• Description
• Technical Analysis
• Affected Products
• CVSS Scoring
• Vulnerability Scoring Details
• CWE Classification
• Attack Prerequisites
• Exploitation Scenarios
• Impact Assessment
• Asset Discovery
• Detection and Indicators of Compromise
• Mitigation and Remediation
• Workarounds
• Vendor Response
• References
• Disclaimer
• Document Revision History

Executive Summary

A critical, unauthenticated remote code execution vulnerability exists in Dahua EIMS (Enterprise Information Management System) versions prior to 2240008. The flaw is a command injection in the HTTP endpoint capture_handle.action, where the captureCommand parameter is passed to an underlying OS command executor without authentication, sanitization, or adequate input validation.

Any remote attacker who can reach the EIMS web interface can send crafted HTTP requests that inject arbitrary operating-system commands. Those commands execute in the server context, enabling full system compromise — data theft, persistence, lateral movement, ransomware deployment, and disruption of dependent physical-security workflows.

The vulnerability receives the maximum CVSS 4.0 base score of 10.0 (CRITICAL) with High impact across confidentiality, integrity, and availability on both the vulnerable system and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Exploitation evidence has been observed in the wild.

EIMS is an enterprise back-end platform, not a field IPC camera. Compromise typically affects central management, access control integrations, and organizational data rather than a single sensor. Treat internet-exposed or VLAN-reachable EIMS instances as emergency patch priority.

At a Glance

Relationship to Other Dahua CVEs

This repository also documents field-device advisories from Dahua's 2026 PSI batch. CVE-2024-13985 is a separate product line with a far higher severity profile.

Defender takeaway: Patching cameras does not remediate EIMS. Inventory application servers running Dahua enterprise software independently.

Vulnerability Timeline

Description

Dahua EIMS provides enterprise-level information management capabilities used in integrated security and building-management deployments. A network-facing servlet or action handler exposed at capture_handle.action accepts a parameter named captureCommand.

Failure Mode

The application treats captureCommand as input to a host operating system command (directly or via a shell wrapper) without:

• Requiring an authenticated session
• Validating allowed character sets or command vocabulary
• Escaping shell metacharacters
• Using safe APIs (e.g., parameterized process invocation with fixed executable and argument array)

An unauthenticated attacker submits crafted HTTP requests containing command injection payloads in captureCommand. The server executes attacker-controlled OS commands with the privileges of the EIMS application process — typically a privileged service account on Windows or Linux hosts.

Consequences

Successful exploitation leads to:

Technical Analysis

Endpoint and Parameter

The .action suffix is characteristic of Apache Struts2 or Struts-style Java MVC frameworks commonly used in enterprise Java web applications. While the vendor bulletin describes command injection rather than naming the framework, defenders should inspect EIMS deployments for Java web containers (Tomcat, etc.) and reverse proxies forwarding to that endpoint.

CWE-78 — OS Command Injection Mechanics

CWE-78 arises when application code concatenates untrusted input into commands interpreted by /bin/sh, cmd.exe, or equivalent:

# Conceptual vulnerable pattern (pseudocode — not vendor source)
Runtime.exec("capture-tool " + captureCommand);
# or
ProcessBuilder("sh", "-c", "capture-tool " + captureCommand);

Shell metacharacters (;, |, &, `, $(), &&, ||, newlines) allow command termination and arbitrary secondary commands.

Why CVSS 10.0 Is Warranted

Every CVSS 4.0 impact metric in the published vector is High, including subsequent system impacts:

This is among the most severe published scores possible under CVSS 4.0.

EIMS Architecture Context (Operational)

EIMS typically sits centralized in the security architecture:

[Internet / WAN] ──?──> [EIMS Application Server]
                              │
              ┌───────────────┼───────────────┐
              ▼               ▼               ▼
         [Directory]    [Access DB]     [Device APIs]
              │               │               │
              └───────────────┴───────────────┘
                              │
                    [Cameras / Doors / Alarms]

Compromise at the EIMS layer is architecturally worse than compromising a single IPC — it is a control plane breach.

Public Exploitation Ecosystem

Multiple public sources reference this flaw (see References):

• Vendor bulletin on support.dahuatech.com
• CNVD and NVD entries
• Community write-ups (cn-sec.com, CSDN)
• Scanner templates (Nuclei, Pentest-Tools, VulnCheck, S4E)

The presence of scanner signatures and in-the-wild exploitation means opportunistic mass exploitation is an immediate realistic threat, not a theoretical research concern.

Affected Products

Vendor Summary

Totals: 1 affected vendor · 1 affected product (EIMS)

Fixed Version

Version Identification

Operators should record:

1. EIMS build or package version from the admin UI or installer manifest
2. Installed patch level from Dahua support portal entitlements
3. Host OS and deployment topology (standalone vs. clustered)

If version enumeration is unavailable, assume vulnerable until confirmed patched.

What EIMS Is Not

CVSS Scoring

Summary

CVSS 4.0 Metric Breakdown

Maximum Severity Interpretation

A 10.0 under CVSS 4.0 indicates no compensating metric reduces urgency. Patching, isolation, or takedown from untrusted networks should be treated as P0 / emergency.

Vulnerability Scoring Details

Visual summary of the published CVSS 4.0 selector positions:

Exploit Characteristics

Attack Vector:          [Network]  Adjacent  Local  Physical
Attack Complexity:      [Low]      High
Attack Requirements:    [None]     Present
Privileges Required:    [None]     Low      High
User Interaction:       [None]     Passive  Active

Impact on Vulnerable System

Vuln Confidentiality:     None     Low      [High]
Vuln Integrity:           None     Low      [High]
Vuln Availability:        None     Low      [High]

Subsequent System Impact

Subseq Confidentiality:   None     Low      [High]
Subseq Integrity:           None     Low      [High]
Subseq Availability:      None     Low      [High]

CWE Classification

Related Weaknesses (Contextual)

Attack Prerequisites

Remotely Exploitable: Yes

Exploitation Scenarios

Scenario 1 — Internet-Exposed EIMS (Shodan / ZoomEye)

Attackers enumerate app="Dahua EIMS" hosts on internet scan engines, deliver command injection to capture_handle.action, deploy webshell or reverse shell, and exfiltrate enterprise security databases.

Scenario 2 — Ransomware Operator Mass Campaign

Automated scanners identify vulnerable instances. Attackers encrypt EIMS host and connected file shares, demanding ransom while physical access control and visitor management integrations are offline.

Scenario 3 — Lateral Movement from Perimeter Breach

An attacker compromises a DMZ web server, pivots to an internally reachable EIMS instance on a shared management VLAN, and uses EIMS credentials/API keys stored on the host to interact with downstream door controllers and cameras.

Scenario 4 — Insider-Less Espionage

Nation-state or criminal actors silently exfiltrate personnel access logs, visitor records, and building maps without rebooting services — maintaining long-term persistence via cron/systemd backdoors.

Scenario 5 — Supply Chain / Integrator MSP

A managed service provider hosts one EIMS instance for dozens of customers. Single compromise affects all tenants on that server — a concentrated catastrophic failure.

Impact Assessment

Technical Impact

Business Impact

Regulatory and Legal Exposure

EIMS compromise may trigger:

• Breach notification obligations (GDPR, state privacy laws, etc.)
• Critical infrastructure reporting in regulated sectors
• Contractual SLA penalties with physical security customers

Asset Discovery

ZoomEye Query

Defensive Inventory (Authorized Only)

Only scan assets you own or are explicitly authorized to test.

Detection and Indicators of Compromise

Network Indicators

• HTTP GET/POST to /capture_handle.action or path suffix match
• Requests containing captureCommand= with shell metacharacters or encoded equivalents (%3B, %7C, %26, %24, %60, %0A)
• Spike in 4xx/5xx responses followed by new outbound connections from EIMS host
• Unexpected DNS queries or beaconing from application server after anomalous HTTP

Host Indicators

• New cron jobs, scheduled tasks, or systemd units on EIMS server
• Unexpected web shells in Tomcat/webapp directories
• New local users or SSH authorized_keys modifications
• java or tomcat process spawning /bin/sh, cmd.exe, powershell, bash
• Antivirus/EDR alerts on EIMS host correlated with web access logs

Application Log Patterns

• capture_handle.action access from unfamiliar source IPs
• High-frequency identical requests (scanner behavior)
• Errors in command wrapper utilities immediately after suspicious captureCommand values

Threat Intelligence Feeds

Monitor for:

• CNVD-2024-17054 / CVE-2024-13985 signatures
• Nuclei template matches (public templates exist — use for authorized scanning)
• SIEM rules tagging Dahua EIMS exploit attempts

Recommended Emergency Queries (SIEM)

# Example patterns — adapt to your log schema
url:"capture_handle.action" AND captureCommand:*
url:"capture_handle.action" AND (captureCommand:*;* OR captureCommand:*|* OR captureCommand:*&*)

Mitigation and Remediation

Primary Remediation — Upgrade to 2240008+

1. Inventory all EIMS deployments and record versions.
2. Upgrade immediately to version 2240008 or later from Dahua Support Bulletin.
3. Verify patch success via version string and absence of exploitable behavior in authorized regression tests.
4. Rotate all credentials stored on or reachable from the EIMS host (DB, API keys, service accounts, integration passwords).

Emergency Containment (If Patching Is Delayed)

Post-Compromise Recovery

If exploitation is suspected:

1. Isolate the host from network
2. Preserve forensic images before rebuild
3. Rebuild from known-good media (not in-place "cleanup" alone)
4. Rotate all secrets company-wide that were accessible from EIMS
5. Review downstream device configs for unauthorized changes
6. Report per organizational IR and regulatory requirements

Secure Deployment Hardening (Long-Term)

Workarounds

No vendor-sanctioned permanent workaround replaces upgrading to 2240008+. Interim measures:

1. Block external access to capture_handle.action at the reverse proxy/WAF.
2. Air-gap EIMS from untrusted networks until patched.
3. Disable the EIMS web tier if business continuity allows using alternate management paths temporarily.

These are stop-gap controls; vulnerable code remains exploitable by anyone who can reach the endpoint.

Vendor Response

Dahua published a security bulletin via its support portal:

• Bulletin: https://support.dahuatech.com/bulletin/info?IsDpValue=APKncD%2FB

Obtain fixed installers, release notes, and any interim guidance from that bulletin or authorized Dahua support channels.

References

Disclaimer

This document is an informational security advisory compiled from publicly available CVE metadata, vendor bulletins, and industry reporting. It is intended to help defenders understand and prioritize remediation for CVE-2024-13985.

• This README does not provide weaponized exploit code, copy-paste injection payloads, or step-by-step compromise tutorials.
• Technical analysis of framework behavior is inferred where vendor source is unavailable.
• Asset search links are for authorized inventory of your own attack surface.
• Apply patches and containment measures through your organization's change and incident response procedures.
• The authors are not liable for actions taken based on this document.

Responsible use: Test only systems you own or are authorized to assess. Report active exploitation to national CERTs and Dahua support as appropriate.

Document Revision History

_{CVE-2024-13985 · Dahua EIMS · CVSS 4.0 10.0 CRITICAL · CWE-78 · capture_handle.action}