{"id":"CVE-2023-3836","published":"2023-07-22T18:00:05Z","modified":"2024-08-02T07:08:50Z","title":"Dahua Smart Park Management unrestricted upload","vendor":"Dahua","product":"Smart Park Management","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dahua","product":"Smart Park Management","versions":["20230713"]}],"description":{"text":"A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","provenance":"source","from":"CVE.org"},"summary":{"text":"The unrestricted file upload flaw lies in the /emap/devicePoint_addImgIco endpoint of Dahua's Smart Park Management product, where the upload argument is not properly restricted, affecting versions up to 20230713. An attacker with low-privilege authenticated access can exploit this remotely over the network, requiring no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:31Z"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.7367,"percentile":0.9947,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-25","exploitedFirstSeen":"2023-11-25","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-25&host_type=src&vulnerability=cve-2023-3836","date":"2023-11-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-01&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-04&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-10&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-20&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-23&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2023-3836","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-3836","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2023-3836","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-3836","date":"2024-01-24"}],"evidenceTotal":672,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://vuldb.com/?id.235162","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.235162","tags":["signature","permissions-required"]},{"url":"https://github.com/qiuhuihk/cve/blob/main/upload.md","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-44464","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44464","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-08-30","earliestUrl":"https://github.com/zh-byte/CVE-2023-3836","repos":[{"name":"zh-byte/CVE-2023-3836","url":"https://github.com/zh-byte/CVE-2023-3836","stars":0,"created":"2023-08-30"}]},"nuclei":[{"id":"CVE-2023-3836","name":"Dahua Smart Park Management - Arbitrary File Upload","severity":"critical","path":"http/cves/2023/CVE-2023-3836.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3836.yaml"}],"first":{"date":"2023-08-30","source":"PoC-in-GitHub","url":"https://github.com/zh-byte/CVE-2023-3836"},"provenance":"source"},"exploitRefs":["https://github.com/qiuhuihk/cve/blob/main/upload.md"],"flow":[],"timeline":[{"date":"2023-07-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-3836","provenance":"source"},{"date":"2023-08-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/zh-byte/CVE-2023-3836","provenance":"source"},{"date":"2023-11-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-25&host_type=src&vulnerability=cve-2023-3836","provenance":"source"}],"speed":{"daysToPublicExploit":39,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":64.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1069 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9947"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}