CVE-2023-7309

High PUBLISHED

Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload

Zhejiang Dahua Technology Co., Ltd. · Smart Park Integrated Management Platform

Not yet in CISA KEV

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

10.0 Critical

At a Glance

A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability is presumed to affect builds released prior to September 2023 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-02-15 UTC.

CVE Published: Aug 27, 2025
Exploitation Reported: Nov 11, 2025
CVSS: 10.0 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Zhejiang Dahua Technology Co., Ltd.	Smart Park Integrated Management Platform	0 to <= *	Affected

CVE References

Vendor Advisory — support.dahuatech.com support.dahuatech.com · Vendor Advisory https://support.dahuatech.com/bulletin/info?IsDpValue=hJVIA5%2BGjY24R...
Third-Party Advisory — vulncheck.com vulncheck.com · Third-Party Advisory https://www.vulncheck.com/advisories/dahua-smart-park-integrated-mana...
Exploit — developer.aliyun.com developer.aliyun.com · Exploit https://developer.aliyun.com/article/1333161
GitHub — tequilasunsh1ne/dahua_bitmap_fileupload github.com · Exploit https://github.com/tequilasunsh1ne/dahua_bitmap_fileupload

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-11-11 00:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-7309

{
  "cve_id": "CVE-2023-7309",
  "title": "Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload",
  "affected_vendor": "Zhejiang Dahua Technology Co., Ltd.",
  "affected_product": "Smart Park Integrated Management Platform",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 10.0,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-7309

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Timeline

Automate This Intelligence with the Pro API