A critical vulnerability affecting the Dahua Intelligent Connection Center has been identified and linked to active exploitation occurring on the same day as its public disclosure. Tracked as CVE-2025-31704, the security flaw was officially published on October 30, 2026, after having been reserved in the CVE database on April 1, 2025.
The timeline of the vulnerability indicates a significant gap between its initial reservation and its eventual disclosure. Despite the extended period between the reservation date and the publication date, the security issue transitioned immediately into an active threat landscape upon becoming public knowledge.
Evidence of active exploitation was first documented on the day of the disclosure, October 30, 2026. This assessment relies on data provided by commercial threat intelligence research, which identified the vulnerability as being actively leveraged in the wild. While this activity has been reported by research entities, it is important to note that the claim of exploitation currently rests on a single source of intelligence.
As of the current reporting, the vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalogs maintained by major government agencies, including the United States Cybersecurity and Infrastructure Security Agency (CISA) or the European Union Agency for Cybersecurity (ENISA). While data aggregators such as the Computer Incident Response Center Luxembourg (CIRCL) mirrored the information shortly after the initial report, they do not serve as independent confirmation of the exploitation activity.
The vulnerability is currently categorized with an EPSS (Exploit Prediction Scoring System) value of 1.4 percent, placing it in the 71.9th percentile for potential exploitation risk. Because the reports of exploitation have not been verified by the vendor or independent third-party forensic analysis, the specific mechanics of the attack and the scope of the potential impact remain unconfirmed.
Users and administrators of the Dahua Intelligent Connection Center are advised to monitor official channels for further updates regarding this vulnerability. Given the nature of the reports, organizations utilizing this software should prioritize security hygiene and review their systems for any signs of unauthorized access or suspicious activity consistent with the timeline of the disclosure.
