CVE-2023-3836

published 2023-07-22

CVE-2023-3836: A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file…

Priority P1 88 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
dahua	smart_park_management	—	—
dahuasecurity	smart_parking_management	<= 20230713	—

Detection & IOCs extracted from sources · hover to see the quote

url /emap/devicePoint_addImgIco?hasSubsystem=true↗

path /upload/emap/society_new/↗

command POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1 Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT↗

filename ico_res_*_on.jsp↗

other html:"/WPMS/asset"↗

other body="/wpms/asset"↗

• → Detect exploit attempts by monitoring POST requests to /emap/devicePoint_addImgIco?hasSubsystem=true with multipart/form-data content type containing a JSP (or other executable) file upload. ↗
• → Uploaded webshells are placed under /upload/emap/society_new/ and follow the naming pattern ico_res_<alphanum>_on.jsp — monitor GET requests to this path for JSP file access as a post-exploitation indicator. ↗
• → Use the regex pattern 'ico_res_(\w+)_on\.jsp' to identify server-generated webshell filenames in HTTP responses from the upload endpoint. ↗
• → Identify exposed Dahua Smart Park Management instances via Shodan (html:"/WPMS/asset" or http.html:"/wpms/asset"), FOFA (body="/wpms/asset"), or ZoomEye (app="大华智慧园区综合管理平台") for attack surface enumeration. ↗
• → The vulnerability requires no authentication (PR:N, UI:N per CVSS); any unauthenticated POST to the upload endpoint should be treated as a high-fidelity alert. ↗

• · The exploit has been publicly disclosed and a Nuclei template is available, meaning automated mass-scanning is highly likely given the 0.99652 EPSS percentile. ↗
• · The vendor did not respond to early disclosure; no official patch confirmation is available — treat all instances of Dahua Smart Park Management ≤ 20230713 as unpatched until verified otherwise. ↗
• · The Nuclei template is marked 'intrusive' — running it against production systems will actually upload a test file; use with caution in live environments. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 6.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434