Back to updates
UpdatedSep 3, 2026

CVE-2022-25012-dvr4-weak-password-encryption — Updated!

Decrypts weak encrypted passwords from Argus Surveillance DVR systems via CVE-2022-25012, reconstructing plaintext credentials from DVRParams.ini ciphertext.

Share

This is an improved version of the exploit by deathflash1411

Original exploit: https://www.exploit-db.com/exploits/50130

Improved Features

  • Cracked password is now output as reconstructed password string instead of only output character by character
  • The encrypted password string is now entered as an arguement instead of hardcoded
  • The exploit now supports the decryption of all special characters

Usage

The cyphertext can be found at

C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini

Once you have obtained the cyphertext password

./exploit.py <encrypted password>

or

python3 exploit.py <encrypted password>

Footnote

#, &, ', and " are not present in the exploit code because it was found that argus surveillance strips these characters out if you enter them into the password field

Categories