Andrey Bezborodov

The issue concerns hardcoded passwords for the `root` account and an unspecified backdoor account. This makes it easier for remote attackers to gain administrative access. Attackers can exploit this via authorization requests using `ActiveX`, a standalone client, or other unknown vectors.

The issue is related to the improper restriction of UPnP requests, making it easier for remote attackers to gain access. This can be achieved through vectors involving a replay attack against the TELNET port.

The issue makes it easier for remote attackers to obtain access via a brute-force attack due to a small value for the maximum password length.

The issue concerns a password-hash algorithm used by Dahua DVR appliances, which has a short hash length. This makes it easier for attackers to discover cleartext passwords via a brute-force attack.

The issue allows context-dependent attackers to obtain sensitive information. This can be achieved via two vectors: (1) direct access to a file or (2) the user-setup web page, due to the storage of credentials in cleartext.