I've just disclosed creadentials leaks (ending up in clear text) from Dahua SDK to Dahua PSIRT

[bashis]

GitHub - mcw0/PoC: Issues has been disabled for these PoC's, as they are simply PoC, Public Domain and unsupported.

Issues has been disabled for these PoC's, as they are simply PoC, Public Domain and unsupported. - GitHub - mcw0/PoC: Issues has been disabled for these PoC's, as they are simply PoC, Publ...

github.com

 

[speidy]

Is it applicable on new DVRs firmware as well?

 

[bashis]

Is it applicable on new DVRs firmware as well?

Yes

 

[mat200]

Is it applicable on new DVRs firmware as well?

Welcome @speidy

Bashis did some great work here imho. ( thanks Bashis )

 

[bashis]

mcw0/PoC

 

[alastairstevenson]

Wow, that is some list!

PoC: Added simple TCP/37777 DVRIP listener to display decrypted credentials in clear text

That one seems particularly bad -