itres-labs/CVE-2025-31702

GitHubRepository PoCScanner

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository contains Python scripts for decrypting device configuration blobs, generating authentication codes, and brute-forcing device serial numbers via the Dahua P2P cloud service. The scripts interact with live infrastructure to probe for valid serial numbers, which is a scanning activity to identify exposed devices rather than exploiting a vulnerability on a target system.

Backdoor review

No backdoor observed in reviewed code

The repository contains four Python scripts and a README that implement research tools for CVE-2025-31702, a Dahua privilege escalation vulnerability. The scripts perform AES decryption of device data, generate authentication codes, and brute-force device serial numbers via the vendor's P2P infrastructure. All behavior is consistent with the stated defensive research purpose: decrypting local device files, replicating authentication logic, and probing vendor servers to identify valid serial numbers. No concealed executable behavior, persistence mechanisms, credential exfiltration to attacker-controlled infrastructure, or unrelated payloads were observed. The code is plaintext Python with no obfuscation.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareDahua embedded products (IPC, SD series)
Attack typesBrute-forceInformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a scanner. The dahua-sn-brute2.py script systematically probes the Dahua P2P cloud service to identify valid device serial numbers by checking HTTP 200 responses. This is a detection/enumeration activity, not an exploitation of the CVE-2025-31702 vulnerability (which involves accessing restricted data via a crafted HTTP request after obtaining normal user credentials). The README explicitly states the code is for 'defensive use' and 'validation'.

dahua-sn-brute2.py:1-9dahua-sn-brute2.py:133-184README.md:11

Requirements

  • Requires a fixed 10-character serial number prefix to brute-force.dahua-sn-brute2.py:236
  • Requires hardcoded cloud service credentials (USERNAME, USERKEY, RANDSALT) to authenticate with the Dahua P2P server.dahua-sn-brute2.py:28-30
  • Requires network access to www.easy4ipcloud.com on port 8800 and subsequent P2P servers.dahua-sn-brute2.py:25-26

Observed behavior

  • Decrypts Account1SecEData files using a derived AES-256-ECB key based on device class and serial number.dahua-ac1secedata2.py:16-30
  • Generates an authentication code by hashing a formatted blob containing device serial, timestamp, email, and a random hex string.dahua-generatecode2.py:13-33
  • Probes the Dahua P2P cloud service to enumerate valid device serial numbers by sending HTTP requests to /online/p2psrv/{serial} and /probe/device/{serial} endpoints.dahua-sn-brute2.py:133-184
  • Saves discovered valid serial numbers and probe responses to a local file.dahua-sn-brute2.py:178-179
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Endpoint
www.easy4ipcloud.com:8800The brute-force script contacts this Dahua P2P server to resolve device serial numbers and probe device status, which is expected behavior for a tool testing the vendor's infrastructure.dahua-sn-brute2.py:25-26
Credential
USERNAME = "cba1b29e32cb17aa46b8ff9e73c7f40b"Hardcoded authentication token used to authenticate with the Dahua P2P server. This appears to be a shared or example credential for the research tool, not a stolen user credential.dahua-sn-brute2.py:28
Credential
USERKEY = "996103384cdf19179e19243e959bbf8b"Hardcoded key used in the WSSE authentication digest for the Dahua P2P server. Consistent with the research tool's authentication mechanism.dahua-sn-brute2.py:29
File Write
valid_serials.txtThe brute-force script appends discovered valid serial numbers to a local file. This is expected output for a research tool and does not indicate unauthorized data exfiltration.dahua-sn-brute2.py:178-179
Review boundaries

What the analysis did not establish

  • One file (total 5 files, 4 with text content) is omitted from the evidence packet; its content is unknown.
  • The evidence packet reports complete_artifact_coverage is false, so the full repository content is not represented.
  • The analysis is based solely on static code review; no dynamic execution or verification was performed.
  • One text file (total 5 files) was omitted from the evidence packet; its content is unknown and could contain additional information.
  • The analysis is limited to the supplied text content; no dynamic analysis or execution was performed.
  • The hardcoded credentials in dahua-sn-brute2.py are not verified to be example/test credentials rather than leaked production secrets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1