This vulnerability (CVE-2024-13985) is an OS command injection issue classified under CWE-78 affecting Dahua EIMS versions before 2240008. The root cause is the lack of sanitization and authentication on the captureCommand parameter in the capture_handle.action interface, allowing unauthenticated attackers to inject and execute arbitrary OS commands remotely. The CVSS 4.0 base score is 10.0, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and scope. Exploitation evidence was reported by Shadowserver Foundation in April 2024. No patch or official fix is currently documented.

Successful exploitation results in full system compromise of the affected Dahua EIMS server, allowing attackers to execute arbitrary operating system commands remotely without authentication. This can lead to complete control over the system, potentially affecting confidentiality, integrity, and availability of the device and connected infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected interface and monitor for suspicious HTTP requests targeting capture_handle.action. Implement network-level controls to limit exposure of the vulnerable service. Avoid exposing the EIMS management interface to untrusted networks.