CVE-2025-31703 in NVR2-4KS3
Summary
by MITRE • 03/18/2026
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/22/2026
This vulnerability represents a critical security flaw in Dahua network video recorder and external video recorder devices that exposes a fundamental weakness in the device's physical security controls and authentication mechanisms. The issue stems from improper access controls within the device's serial port interface, which allows an attacker with physical proximity to bypass the restricted shell authentication process. This represents a significant bypass of the device's intended security architecture and creates a direct pathway for privilege escalation attacks.
The technical implementation of this vulnerability involves the exploitation of the device's serial communication interface, which typically serves as a diagnostic and administrative access point. When an attacker gains physical access to the device, they can connect to the serial port and leverage a flaw in the authentication implementation that prevents proper verification of credentials or access rights. This weakness in the shell's authentication mechanism enables unauthorized users to bypass the normal access control measures and gain elevated privileges within the system.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with elevated privileges that can be used to manipulate the device's core functionality, access stored video data, modify system configurations, or potentially use the device as a pivot point for attacking other networked systems. The vulnerability is particularly concerning because it can be exploited by attackers who already have physical access to the device, which means that the security model assumes that physical access is controlled and monitored. This scenario represents a failure in the principle of least privilege and demonstrates how physical security controls can be bypassed through flaws in the device's internal access mechanisms.
The attack vector for this vulnerability aligns with the ATT&CK framework's privilege escalation techniques, specifically targeting the T1068 privilege escalation sub-technique, where adversaries leverage weaknesses in system authentication to gain higher-level access rights. This vulnerability also relates to CWE-284, which addresses improper access control in software systems, and CWE-787, which covers out-of-bounds write vulnerabilities that can lead to privilege escalation. The physical access requirement makes this attack more difficult to detect and prevent through traditional network-based security measures, as the attack occurs at the device level rather than through network protocols.
Organizations should implement comprehensive physical security measures including restricted access to device locations, proper cable management to prevent unauthorized serial port access, and regular security assessments of physical access points. Device administrators should disable unused serial ports when not required for diagnostics, implement proper access control lists, and establish monitoring procedures for any unauthorized physical access attempts. Additionally, regular firmware updates and security patches should be applied to address known vulnerabilities in the device's authentication mechanisms. The vulnerability highlights the importance of considering physical security controls in security architecture design and demonstrates how weaknesses in one area of the security model can compromise the entire system's integrity.