DahuaLoginBypass

DahuaLoginBypass Chrome extension that uses vulnerability CVE-2021-33044 to log in to Dahua IP cameras and VTH/VTO video intercom devices without authentication. For other device types NVR/DVR/XVR, etc, there exists CVE-2021-33045 which cannot be exploited with an ordinary web browser. These...

CVE-2025-31702

CVE-2025-31702 — Research tools & DFIR material Repository with tools, exploits and research artefacts related to the analysis and discovery of CVE-2025-31702 and related issues. More info and deep-dive: https://labs.itresit.es/2025/10/15/dahua-cve-2025-31702-p2p-auto-update-eop/ Overview This...

Ingram

English | 简体中文 Intro This is a web camera device vulnerability scanning tool, which already supports Hikvision, Dahua and other devices Installation Please run it under Linux or Mac. Please make sure you have installed Python = 3.8, but 3.11 is not recommended...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit About: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. root@kitploit: use - python3...

DahuaConsole

Dahua Console Versión: Pre-alpha Bugs: Efectivamente TODO: Muchas cosas Requisitos de instalación root@kitploit: sudo pip3 install -r requirements.txt Argumentos root@kitploit: -h, --help show this help message and exit --rhost RHOST Remote Target Address IP/FQDN --rport RPORT Remote Target Port...

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capturehandle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without...

Dahua Security - Configuration File Disclosure

A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and...

cve-2021-33045

cve-2021-33045 Log in to the camera's web page by modifying the packets sent by the browser to /RPC2Login. Here, a mitmproxy script is used to implement the relevant functionality. Similar functionality can also be implemented using Fiddler or Burp Suite. Usage: root@kitploit: mitmweb --showhost...

LoHongCam-CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit About: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. root@kitploit: use - python3...

CVE-2023-3836

大华智慧园区综合管理平台publishing文件上传 POC 安装依赖 root@kitploit: pip install argparse requests rich 注意:使用的是python3的环境 使用 root@kitploit: python CVE-2023-3836.py -h 文件内url格式 运行结果...

Dahua Smart Park Management - Arbitrary File Upload

Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePointaddImgIco?. id: CVE-2023-3836 info: name: Dahua Smart Park Management - Arbitrary File Upload...

DAHUA_AUTH-BYPASS-CVE-2021-33044

Dahua Authentication Bypass Exploit Simulation PoC CVE-2021-33044 Overview Dahua IP cameras are IoT devices commonly used in security surveillance systems. Due to frequent deployment in internal networks or Internet access, security vulnerabilities in IP cameras can severely impact privacy and...

PoC

PoC PoC variados - Internet de cosas inseguras Merece mucho la pena leer sobre estas cosas inseguras de mala calidad: https://ipvm.com/reports/security-exploits Hikvision CVE-2021-36260 2021-10-19 Todo el crédito para WatchfulIP https://watchfulip.github.io/...

dahua-dvr-metasploit

This repository does not have a README...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit About: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. root@kitploit: python3...

CVE-2026-29114

CVE-2026-29114 — 大华（Dahua）设备CA根证书暴露 公告类型： 厂商协调的安全披露 CVE ID： CVE-2026-29114 厂商： 大华技术（Dahua Technology） 发布时间： 2026-06-10T05:44:50 UTC 最后修改： 2026-06-10T05:44:50 UTC 来源： 大华产品安全事件（PSI）信任中心 目录 执行摘要 概览 与相关CVE的关系 漏洞时间线 描述 技术分析 受影响产品 CVSS评分 漏洞评分详情 CWE分类...

CVE-2026-29115

CVE-2026-29115 — Denegación de servicio remota autenticada en Dahua Tipo de aviso: Divulgación de seguridad coordinada con el proveedor ID CVE: CVE-2026-29115 Proveedor: Dahua Technology Publicado: 2026-06-10T06:08:21 UTC Última modificación: 2026-06-10T06:08:21 UTC Fuente: Centro de confianza de...

CVE-2024-13985

CVE-2024-13985 — Dahua EIMS capturehandle.action 远程代码执行 公告类型： 厂商协调的安全披露 · 已报告活跃利用 CVE ID： CVE-2024-13985 CNVD ID： CNVD-2024-17054 厂商： 浙江大华技术股份有限公司 产品： EIMS（企业信息管理系统） 发布时间： 2025-08-27T21:23:37 UTC 最后修改： 2026-05-15T11:14:33 UTC 来源：...

CVE-2026-29116

CVE-2026-29116 — 大华未认证远程拒绝服务 公告类型： 厂商协调安全披露 CVE ID： CVE-2026-29116 厂商： 大华技术 发布时间： 2026-06-10T06:16:34 UTC 最后修改： 2026-06-10T06:16:34 UTC 来源： 大华产品安全事件 PSI 信任中心 目录 执行摘要 概览 漏洞时间线 描述 技术分析 受影响产品 CVSS 评分 漏洞评分详情 CWE 分类 攻击前提 利用场景 影响评估 检测与入侵指标 缓解与修复 临时解决方案 厂商响应 参考资料 免责声明 文档修订历史 执行摘要...