CVE-2025-31703

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges.

Metrics

CVSS 4.0 2.4/10CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-305

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 18, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-31719.8A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown cCVE-2025-317108.4In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privCVE-2025-317116.2In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additCVE-2025-317126.2In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no CVE-2025-317138.4In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of priCVE-2025-317146.8In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additCVE-2025-317159.8In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeCVE-2025-317165.1In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no addCVE-2025-317177.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-317187.5In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additCVE-2025-317195.1In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature results with low probCVE-2025-31729.8A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects
CVE-2025-31703: Low severity, CVSS 2.4 | Vulnix