logo_clicknbuy.png

CVE-2023-7309 – Dahua Smart Park Integrated Management Platform SOAP Path Traversal Remote Code Execution Vulnerability

The following table lists the changes that have been made to the
CVE-2023-7309 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Aug. 27, 2025

    Action Type Old Value New Value
    Added Tag unsupported-when-assigned
    Added Description A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability is presumed to affect builds released prior to September 2023 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined.
    Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-22
    Added CWE CWE-434
    Added Reference https://developer.aliyun.com/article/1333161
    Added Reference https://github.com/tequilasunsh1ne/dahua_bitmap_fileupload
    Added Reference https://support.dahuatech.com/bulletin/info?IsDpValue=hJVIA5%2BGjY24RaJ%2FIGLBoTg6hGbLYAQKuf5hnmPaK9M%3D
    Added Reference https://www.vulncheck.com/advisories/dahua-smart-park-integrated-management-platform-front-end-arbitrary-file-upload
Share the Post:

Related Posts