A vulnerability in Dahua Intelligent Connection Center allows a remote attacker to send a specially crafted request that results in arbitrary command execution. The flaw manifests as a command injection that bypasses input validation, enabling the attacker to run any shell commands with the service’s privileges. The impact is loss of confidentiality, integrity, and availability for the affected infrastructure, as the attacker gains full control over the command execution environment.

The affected product is Dahua Intelligent Connection Center. No specific version information is listed in the advisory, so all installations of the product remain potentially vulnerable until a vendor update is applied.

The CVSS score of 9.8 indicates a critical risk level. EPSS data is not supplied, so the current exploit probability cannot be quantified, but the absence of an EPSS score does not diminish the seriousness of the known remote code execution capability. The vulnerability is not yet listed in the CISA KEV catalog, yet its high severity and the fact that an attacker only needs to send a crafted request over the network suggest a high likelihood of exploitation once publicized. The likely attack vector is remote over the network, inferred from the description of a remotely sent request.