Dahua, Hikvision IoT Devices Under Siege
Summary: Dahua shipped firmware closing an authentication flaw that let anyone download the device's user database with usernames and password hashes, then pass the hash back to the local Web server to gain admin access; researcher Bashis posted exploit code to Full Disclosure on March 5 before pulling it, and Dahua's March 6 advisory named nearly a dozen affected camera and DVR models. Separately, Hikvision users reported being locked out of internet-exposed devices running the default credential 12345 with unauthorized "system" accounts added, and a programmer writing as Montecrypto threatened on March 5 to publish backdoor details on March 20.
What you should know: Dahua's products are heavily represented among the systems the Mirai worm seeks out, so unpatched cameras and DVRs on your network are candidate recruits for a botnet - and the exploit code was already copied to multiple sites before it was taken down.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026