CVE-2023-7309
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A path traversal vulnerability in the Dahua Smart Park Integrated Management Platform (also known as Dahua Smart Campus Integrated Management Platform) affects the SOAP-based GIS bitmap upload interface. It allows unauthenticated remote attackers to upload arbitrary files, including executable JSP payloads, potentially leading to remote code execution (RCE) and full system compromise. The vulnerability affects builds released before September 2023, with newer versions containing a fix.
Risk Assessment
The risk to the organization includes the possibility of a complete system takeover by an unauthenticated attacker, which could lead to data theft, service disruption, or use of the system as a foothold for further attacks.
Recommendation
It is recommended to immediately update the Dahua platform to the latest version that includes the fix. Additionally, restrict access to the SOAP interface to trusted networks only and monitor logs for suspicious requests.
Related vulnerabilities
- CVE-2026-19117Critical
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
- CVE-2026-66786Critical
In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.
- CVE-2026-53671Critical
In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.
- CVE-2026-53670Critical
In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.
- CVE-2026-53649Critical
Joro before version 1.1.1 in default proxy mode exposes a local API on 127.0.0.1:9090 with no authentication and wildcard CORS. A malicious website can reach privileged endpoints, including uploading a native plugin and triggering a restart, leading to unauthenticated remote code execution as the operator's user.
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20212Critical
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. TCP ports 43210 and 43211 are accessible in the default L3 VRF, and crafted input can lead to code execution or crash of the S1HAL process causing device reload.
- CVE-2026-53611Critical
Looking Glass prior to version 1.3.5 contains an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- CVE-2026-82955Critical
In the current development version of Eclipse aeriOS, the KrakenD instance in the API Gateway had disable_jwk_security hard-coded to true, disabling TLS certificate verification when retrieving JWKS. This could allow an attacker to intercept communication and provide a malicious JWKS, compromising token validation. The issue has been fixed by making the parameter configurable and defaulting to false.
Original NVD description (English source)
A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability is presumed to affect builds released prior to September 2023 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-02-15 UTC.