r/Dahua

An operator left their full working directory exposed on an open HTTP server. Hunt.io crawled it, 2,616 files, and rebuilt the campaign from the corpus.

• Three exploitation paths in parallel: an asyncio credential brute-forcer, a CVE-2021-33044/33045 auth-bypass chain, and P2P relay abuse reaching cameras by serial number
• The relay path never authenticates the connecting party, only the session, via a cloud-issued token obtainable with the fixed SDK credentials in every Dahua client
• Two CVE labels in the tooling don't hold up: CVE-2024-39943 is an unrelated Rejetto HFS flaw, and CVE-2025-31702 is a narrower post-auth case, not the unauthenticated relay abuse (that path is a separate non-CVE issue documented by ITRES)
• Full PTCP tunnel breakdown, including the Inverted STUN packet and the bind-to-127.0.0.1 technique

Neutral attribution throughout, the corpus shows how the operation was built and run, not who ran it.

Check the full breakdown, IOCs and mitigation strategies:
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised

!!!!

does this camera support it? I can’t get it to work. spec sheet just says built in mic and speaker (and line in/out). I can get alarm sounds to play but can’t connect to rtsp back channel. I can see it if I use proto=Onvif, but can’t access it. the spec sheet for the international model 5449R1-ze whatever says that it can “realize” 2-way talk. not sure what that means.

is Dahua DMSS app or cloud having a service degradation event. My NVR is online, I can confirm it is connected to the internet as I have SFTP configured. Home internet is working because other Smart home devices are working normally. Dahua app is misbehaving. Mostly the DVR is showing offline.

No matter what I do, the VTH remains Offline in the VTO screen.

I can see the images from the VTO, but no notification appears when pressing.

VTO is configured as (Main)SIP server.

VTH is configured as (Main)VTH.

Passwords checked.

The IP range is correct. Performed a factory reset several times, but nothing helps.

Both devices are running the most recent firmware: 4.81.

I read somewhere that it can sometimes take 5-10 minutes for a VTH to come online, but mine remains OFFLINE!

Does anyone know how I can solve this?

I'm hoping someone with hands-on experience with the new VTO2202F-P-S3 can help.

Hardware

Dahua VTO2202F-P-S3

Dahua ASR2101A-ME (RS-485 card reader)

Dahua VTH2622G-W

Firmware / Software

Latest VTO firmware: V4.810.0000000.3.R.260528 (EMEA)

SmartPSS Lite V1.006.0000000.1

Latest ConfigTool

Wiring

ASR2101A-ME connected directly to the VTO over RS-485.

Reader type is configured as Card Reader.

D0/D1 are not connected.

The door lock is connected directly to the VTO relay.

Symptoms

The ASR reads every MIFARE card correctly.

Every swipe appears in the VTO web interface → journal Unlock Records.

Example:

Unlock Method: Card Swipe Unlock

Card: 003108CE

Person ID: -

Result: Failed

The reader gives 3 beeps and a red LED, so the VTO is actively rejecting the card.

What I've already verified

RS-485 communication works.

The card UID is always detected correctly.

Users are created in SmartPSS Lite.

Card is assigned to the user.

Permission Rules are created.

Authorization Progress reports Successfully sent.

User validity dates are correct.

Remote Unlock works correctly.

The strange part

If I run Extract in SmartPSS Lite after synchronization:

Users are extracted correctly.

Every user has 0 cards.

It looks like the VTO never actually stores the card database.

Other observations

The VTO web interface has no Card Management / Issue Card menu, although the official manual clearly shows it.

ConfigTool → Device Config returns "Not Supported Yet".

The VTH displays "Cards are temporarily unavailable."

SmartPSS Lite does not show the card swipe events. They only appear in the VTO web Unlock Records.

My question

Has anyone successfully configured VTO2202F-P-S3 + ASR2101A-ME for standalone MIFARE card access?

Specifically:

Does Extract return card data on your system?

Do you have the Issue Card menu on the latest 4.810 firmware?

Is there an undocumented enrollment step for this firmware?

Or is this a known firmware bug?

Any help would be greatly appreciated because I've exhausted all the obvious troubleshooting steps.