Loading vulnerability…
CVE-2025-31700 is a stack-based buffer overflow in Dahua security camera firmware affecting the ONVIF request handler exposed on port 80. The vulnerable code incorrectly parses the HTTP Host header and performs an unbounded copy onto a stack buffer without enforcing the destination size. Reported triggering conditions include a malformed Host header that causes arbitrary-length data to be written to stack memory. This memory corruption can overwrite saved control data, including the return address and other stack-resident register state, enabling unauthenticated remote exploitation. Depending on exploit reliability and platform protections such as ASLR, the flaw can be used to crash the service or achieve remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains three Python utilities plus a README: (1) dahua_auth_bypass.py is the main exploit PoC for CVE-2021-33044/CVE-2021-33045, (2) dahua_exploit.py is a broader multi-CVE tester, and (3) dahua_scanner.py is a network scanner/fingerprinter for Dahua devices. The core exploit logic targets Dahua HTTP RPC2 authentication by first requesting a login challenge from /RPC2_Login, extracting realm/random/session values, then computing a crafted MD5 hash equivalent to an empty-password login flow. Vulnerable firmware reportedly accepts this hash and returns a valid session ID, enabling authenticated RPC2 calls without knowing the real password. Post-authentication capabilities in dahua_auth_bypass.py include querying device type, software version, system info, and dumping user information via RPC2 methods. The scripts also attempt common default credentials as a fallback on patched devices. The scanner script performs TCP port checks, HTTP/HTTPS fingerprinting using Dahua-specific strings, probes /RPC2_Login for Dahua-style challenge responses, and tries CGI endpoints under /cgi-bin/magicBox.cgi for model/firmware identification. The multi-CVE script additionally references CVE-2025-31700/CVE-2025-31701 as buffer-overflow/DoS tests, but the provided content is truncated, so only its stated purpose can be confirmed. Overall, this is an operational network exploit toolkit for Dahua device discovery, authentication bypass testing, credential checking, and limited post-exploitation enumeration.
This repository is a small standalone Python exploit toolkit for Dahua devices, centered on CVE-2021-33044 authentication bypass. It contains three executable scripts and a README. The main exploit logic is in dahua_auth_bypass.py, which implements the Dahua RPC2 challenge-response flow against /RPC2_Login, derives the MD5-based login hash using an empty password field, and attempts to obtain a valid authenticated session as admin. If successful, it can optionally perform post-auth RPC2 enumeration through /RPC2, including device type, software version, system information, and full user list retrieval. The same script also includes a fallback default-credential check using common Dahua usernames/passwords. The second script, dahua_exploit.py, is a multi-CVE wrapper. From the visible code, it reuses the same RPC2 auth-bypass and default-credential logic, and the README plus code comments indicate an additional buffer-overflow/DoS test path for CVE-2025-31700/CVE-2025-31701. Because the file content is truncated, the exact overflow endpoint and packet structure are not fully visible, but the script clearly positions itself as a combined vulnerability tester rather than a pure single-exploit PoC. The third script, dahua_scanner.py, is a network discovery and fingerprinting utility. It scans user-supplied hosts/subnets and ports, performs TCP connect checks, probes HTTP/HTTPS root pages for Dahua-specific strings, tests /RPC2_Login behavior, and attempts CGI-based fingerprinting via /cgi-bin/magicBox.cgi?action=getDeviceType and getSoftwareVersion. It also contains helper logic for the same RPC2 hash generation and login testing, indicating it can identify vulnerable or weakly configured devices at scale. Overall, the repository purpose is offensive security research and validation of Dahua device exposure: discover devices, identify Dahua services, test for CVE-2021-33044/33045 auth bypass, try default credentials, and enumerate device/user information after access. It is not just a detector; it contains working exploit logic that can produce an authenticated session on vulnerable targets.
Repository contains Python PoC tooling targeting Dahua device vulnerabilities, primarily over the Dahua RPC2 HTTP interface and the DVRIP/binary service. Structure (8 files): - README.md / SECURITY.md: usage, legal disclaimers, and CVE overview. - dahua_auth_bypass.py: dedicated exploit for CVE-2021-33044 and CVE-2021-33045. Implements the two-step RPC2 challenge-response flow against /RPC2_Login, but crafts the response hash using an empty password (MD5("admin:realm:")) to obtain an authenticated admin session. Includes fallback default-credential testing and post-exploitation enumeration via /RPC2 methods (magicBox.getDeviceType/getSoftwareVersion/getSystemInfo and userManager.getUserInfoAll). - dahua_rce.py: DoS/vulnerability-probe for CVE-2025-31700 and CVE-2025-31701. Sends oversized JSON fields to /RPC2_Login (HTTP overflow probe) and an oversized DVRIP frame to TCP/37777 (binary overflow probe). Determines likely vulnerability via crash indicators (timeouts, connection resets, 5xx) and by checking HTTP reachability before/after. - dahua_scanner.py: subnet/host scanner and Dahua fingerprinting utility. Checks open ports, fetches / over HTTP/HTTPS for Dahua signatures, probes /RPC2_Login for realm/random behavior, and includes logic for auth-bypass/default-cred style checks (full fingerprinting function is truncated in provided content but intent is clear). - dahua_exploit.py: multi-CVE runner combining auth-bypass test, default-credential checks, and buffer-overflow probe logic; file content is partially truncated, but visible portions show the same /RPC2_Login challenge/login flow and a run_all() summary output. Main exploit capabilities: - Network-based authentication bypass to obtain an admin session token on vulnerable firmware (CVE-2021-33044/33045). - Post-authenticated RPC2 enumeration (device type/version/system info and user list) using the obtained session. - Network-based overflow-style malformed input probes over HTTP and TCP/37777 intended to cause crash/DoS and infer potential RCE conditions (CVE-2025-31700/31701), though the provided code is primarily a DoS/vulnerability confirmation rather than a full RCE chain. - Network discovery/fingerprinting and batch testing across subnets and common Dahua ports. Notable targets/endpoints: - HTTP: /RPC2_Login (challenge + login + overflow probe), /RPC2 (authenticated method calls), / (reachability/fingerprinting). - TCP: 37777 (Dahua DVRIP/binary protocol overflow probe). Overall purpose: a small, standalone (non-framework) toolkit for authorized security testing of Dahua cameras/NVR/XVR devices—covering discovery, auth-bypass exploitation with optional data enumeration, and overflow-based DoS/vulnerability probing.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in Dahua camera firmware caused by improper parsing and copying of the HTTP Host header in the ONVIF request handler on port 80, enabling arbitrary memory overwrite and possible DoS.
An unauthenticated stack-based buffer overflow in the Dahua camera ONVIF protocol handler that can lead to full remote code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.