Two parts of the building's camera system are reachable from anywhere on the
public internet, at the building's internet address 162.255.94.170:
This was assessed passively and with the Board's authorization: we looked only at what the systems reveal to any internet user. We did not log in and did not view any footage. The concern is not that we saw video — it is that the front door has been left open to the internet, on equipment that is known to be targeted, since 2021.
The camera system may well be on its own isolated network inside the building — but that isolation has been negated at the building's router, which publishes the recorder directly to the public internet (most likely so the vendor can log in remotely). Network isolation protects against threats on neighbouring internal networks; it does nothing once a device is deliberately opened to the whole internet. Worse: if that internet-facing recorder were broken into, the intruder would land inside the very isolated camera network the HOA set up to contain such a breach. The isolation is providing a false sense of security.
The recorder is made by Dahua, a Chinese manufacturer that the U.S. federal government has banned from government use on national-security grounds (NDAA §889, effective 2020) and that the FCC placed on its Covered List in 2022 (no new U.S. sales authorizations). This is not illegal for a private HOA to own, but it is a material reason to reconsider the platform — and it raises the stakes of leaving one exposed to the internet.
Camera recorders of this brand and vintage, left open to the internet, are among the most heavily scanned and compromised devices on the web — used to steal footage and to recruit the device into criminal botnets. Because this system has been exposed since 2021, it must be treated as potentially already accessed by outsiders, whether or not anyone can prove a specific break-in today. The recommended fix is the same either way.
Technical findings, the verbatim data these systems serve to the public internet, the specific security vulnerabilities involved, and references follow.
Authorized by the HOA Board as system owner. Method was passive and read-only throughout — no credentials submitted, no configuration or controls touched, no video accessed. To rigorously separate “reachable from the public internet” from “reachable only within the building’s shared network,” reachability was checked from three independent vantage points:
| Vantage point | What it establishes |
|---|---|
| 1 · On-building probe host inside a unit; public egress 162.255.94.169 | Reachability from within the building network. On its own this cannot prove public exposure — a building-edge “NAT hairpin” can make a purely internal path appear external. Used only as a first pass. |
| 2 · Off-network probe T-Mobile cellular; public egress 172.56.65.57 (T-Mobile USA, AS21928 — different owner & network from the building) | The decisive test. A connection from a network with no relationship to the building; anything reachable here is genuinely exposed to the public internet. |
| 3 · Third-party scanner Shodan internet-wide scan record | Independent corroboration that an outside party has already observed the open ports on this IP. |
This distinction is not academic: it is the difference between “exposed to the entire internet” and “exposed across the building’s shared network.” Both warrant action; the required remediation differs.
162.255.94.170 (ISP: Gigsouth)| Port / service | On-building | Public internet |
|---|---|---|
88 — Dahua web login | OPEN | OPEN — public (cellular + Shodan) |
9333 — IntuVision analytics | OPEN | OPEN — public (cellular + Shodan) |
91 — secondary web service | not characterized | OPEN — public (cellular + Shodan) |
37777 — Dahua SDK/DVRIP (control + streaming; SmartPSS port) | OPEN | OPEN — public (cellular-confirmed) |
37778 — Dahua UDP companion | OPEN | OPEN — public (cellular-confirmed) |
554 — RTSP (direct stream) | closed | closed — not forwarded (mitigating) |
| 22 / 80 / 443 / 3389 | closed | closed |
The identical open-port set (88, 91, 9333, 37777, 37778) was observed
from T-Mobile cellular (egress 172.56.65.57, AS21928 — a network with no relationship
to the building), and independently corroborated by Shodan's internet-wide scanner. This rules out a
building-internal NAT hairpin: the exposure is to the open internet. Only RTSP (554) and RDP (3389)
are not exposed.
| Recorder — brand/type | Dahua DVR/NVR, device type X72A3A |
| Recorder — Web GUI | version 3.2.7 (build 144753); media plugin 4.1.63 |
| Recorder — firmware age | web assets dated 2021-10-13 (several years old) |
| Recorder — configured ports | RTSP 554, TCP/SDK 37777, HTTP 88 (from the device's own cap.js) |
| Analytics — product/version | IntuVision 17.0.6.18932 on Windows host DESKTOP-1JL79ER |
| Analytics — site record | site name Gallery; site GUID a3e3c68b-766c-4fae-bfc8-1ef740c82ee7; commissioned 2021-11-04; license valid through 2027-02-15 |
| Analytics — licensed modules | Core, Security, Traffic, Standard — 4 package IDs |
| Cameras on system | 4 (server field cameras-total) |
| Integrator (disclosed by server) | TeleNavigators · Dave Klepp · Dave@ess.guru |
Field labeled site-pin | 560071 — purpose unconfirmed (may be a vendor/site identifier; confirm & rotate) |
Partly reassuring: the recorder's protected control APIs require authentication (every
magicBox/configManager request returned HTTP 401),
and the classic Dahua unauthenticated password-disclosure URLs are not present on this
firmware (HTTP 404). Only the login page itself is reachable
(HTTP 200). In other words, the device is exposed but asking for a
password — not trivially wide-open through the best-known holes. The remaining realistic risks
(weak/default password; a firmware-specific authentication-bypass vulnerability) are covered on the last
page and are what any further, separately-authorized testing would examine.
A single router port-forward rule for port 37777 (Dahua's SmartPSS remote-management port) is the most likely reason this recorder is internet-facing — it lets the vendor connect from off-site. But that rule bridges the isolated camera VLAN to the public internet. VLAN/segmentation isolation is a control against lateral movement between internal networks; it is not a control against a device that has been deliberately published to the internet at the perimeter. The recorder therefore functions as an internet-reachable pivot point into the isolated segment — the exact outcome the isolation was intended to prevent. Remediation must move remote access behind a VPN so the isolation holds end-to-end.
The following is copied exactly as the systems served it to an unauthenticated internet connection (the same responses were observed from the T-Mobile cellular vantage). Nothing here required a login. This is the raw basis for the findings above.
~1,900 bytes returned immediately on connection. Readable fields shown verbatim:
cap.js (served unauthenticated to every visitor)| Reference | Relevance here |
|---|---|
| CVE-2021-33044 / -33045 | Unauthenticated remote authentication bypass on Dahua login (CVSS 9.8); listed by CISA as exploited in the wild. Fixed only in firmware released after Sept 2021. This unit's web assets date to Oct 2021 — the patch boundary, so patch status cannot be confirmed externally. This is the single most important open question. |
| CVE-2013-6117 | Unauthenticated credential/serial disclosure directly off port 37777. Almost certainly patched on 2021 firmware, but it is the reason an open 37777 is treated as high-risk. |
| Internet exposure of 37777 | Well-documented mass-compromise vector: exposed Dahua recorders are continuously scanned, indexed by IoT search engines (Shodan/ZoomEye), and recruited into botnets; breaches commonly combine an open 37777 with default accounts (Dahua 888888/666666) or weak admin passwords. |
NDAA §889 (effective Aug 2020) bars the U.S. federal government from procuring or using Dahua video-surveillance equipment on national-security grounds. The FCC added Dahua to its Covered List and in Nov 2022 prohibited new U.S. equipment authorizations. Private organizations are not legally barred from owning Dahua gear, but many enterprises and HOAs are moving off it for the same risk reasons — relevant to any decision about upgrading versus replacing.
88,
37777, 37778 (recorder) and 9333 (analytics). Highest impact,
lowest risk.888888/666666 accounts.site-pin's
role with the vendor and rotate if it grants access.All below are non-destructive, stop at proof-of-access, and view no footage: (a) test a small set of known-default credentials on the recorder; (b) determine whether this firmware is vulnerable to CVE-2021-33044/33045; (c) review public IoT-scanner history for this IP to gauge how long it has been indexed. These would confirm whether the exposure was actually exploitable, to inform notification decisions.