CVE-2023-3836: Dahua Smart Park Management unrestricted file upload via devicePoint_addImgIco

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and a public exploit plus very high EPSS make this an urgent risk.

What it is

Dahua Smart Park Management (up to 20230713) contains an unrestricted file upload flaw in /emap/devicePoint_addImgIco?hasSubsystem=true, where the 'upload' argument is not properly validated. A remote, unauthenticated attacker can upload arbitrary files, which can lead to code execution on the server. The vendor was contacted but did not respond, so no official fix is confirmed.

Impact

An attacker can upload and potentially execute arbitrary files on the affected server, gaining full control over confidentiality, integrity and availability. This can result in remote code execution, data theft, or use of the host as a pivot point.

Attack surface

Reachable over the network via HTTP requests to /emap/devicePoint_addImgIco?hasSubsystem=true; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication or user interaction is required.

Exploitation

A public exploit is referenced (GitHub upload.md) and EPSS is 0.7367 (99.4th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the latest vendor patch or firmware update for Dahua Smart Park Management if available; the vendor did not respond to the disclosure, so confirm with Dahua support.
• If no patch exists, restrict network access to the /emap/ endpoint to trusted management networks only.
• Enforce strict file type, extension and content validation on all upload endpoints, and store uploaded files outside the web root.
• Deploy a WAF rule to block or inspect uploads to /emap/devicePoint_addImgIco and similar endpoints.
• Monitor for and remove any unexpected files written to web-accessible directories.

Detection

• Search web server and application logs for POST requests to /emap/devicePoint_addImgIco?hasSubsystem=true, especially with multipart uploads.
• Monitor file system changes in web-accessible directories for newly created executable or script files.
• Alert on outbound connections or process creation spawned by the web server process, which may indicate uploaded payload execution.
• Use file integrity monitoring to detect unauthorized additions to the application directory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.