A misuse of a restricted shell accessed through a serial port allows a third‑party malicious attacker who has physical access to a Dahua NVR or XVR device to bypass authentication and gain elevated privileges. This improper restriction is classified as CWE‑305 and can lead to unauthorized control or modification of the device’s configuration and operation.

The vulnerability affects Dahua NVR2‑4KS3, Dahua XVR1B16H‑I/T, and Dahua XVR4232AN‑I/T models. No specific firmware or hardware version ranges are provided in the CNA data.

The CVSS score of 2.4 indicates a low severity, and the EPSS score is not available, with no listing in CISA’s KEV catalog. The requirement of physical access to the serial port makes exploitation less likely in general environments, but once an attacker is in proximity, the lack of authentication enables immediate privilege escalation. The combination of low CVSS and physical access requirement results in a moderate overall risk that warrants inventorying exposed serial ports and applying vendor patches when available.