CVE-2024-13985

Dahua EIMS capture_handle.action RCE

10.0 CriticalPublic exploit

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

15.1%Up 14.9 points since Aug 28, 2025

What each source reports

CVE List Score used 10.0

Dahua EIMS capture_handle.action RCE

Record: CVE-2024-13985
CVSS 4.0: 10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2024-54921 10.0

Record: EUVD-2024-54921
CVSS 4.0: 10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gqv2-wjhw-h44w 10.0

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated...

Record: GHSA-gqv2-wjhw-h44w
CVSS 4.0: 10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-78
Updated: 2026-11-02

NVD 10.0

Record: CVE-2024-13985
CVSS 4.0: 10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-78
Updated: 2026-11-02

Affected products

zhejiang dahua technology co., ltd. eims

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle
PoC in GitHub	CrimsonfiedOfficial/CVE-2024-13985	2026-07-11

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-13985 is a critical vulnerability (CVSS 10.0) in Zhejiang Dahua Technology Co., Ltd. Eims, published August 27, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.1%, the 96th percentile. No source names a fixed version.

References

Show 4 moreShow less