Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：346436）

Rule General Information


Release Date:		2026-10-14

Rule Name:		Dahua EIMS capture_handle.action Command Injection Vulnerability (CVE-2024-13985)

Severity:

CVE ID:

Rule Protection Details


Description:		A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.

Impact:		An attacker can execute arbitrary command via a successful exploit in the context of the vulnerable software.

Affected OS:		Windows, Linux, Others

Reference:		https://blog.csdn.net/weixin_43567873/article/details/136636198 https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/dahua/dahua-eims-capture-handle-rce.yaml https://s4e.io/tools/dahua-eims-remote-code-execution https://cn-sec.com/archives/2554372.html https://support.dahuatech.com/bulletin/info?IsDpValue=APKncD%2FBd6zIq4O2BUpuhjg6hGbLYAQKuf5hnmPaK9M%3D https://pentest-tools.com/vulnerabilities-exploits/dahua-eims-remote-command-execution_23961 https://www.vulncheck.com/advisories/dahua-eims-rce https://www.cnvd.org.cn/flaw/show/CNVD-2024-17054

Solutions

Refer to the announcement or patch by the vendor.