Security cameras made by the Chinese company Dahua are vulnerable to two authentication bypass vulnerabilities. Tracked as CVE-2021-33044 and CVE-2021-33045, a proof-of-concept exploit was posted to GitHub on October 7th as part of a full disclosure. Over 1.2 Dahua systems are on the internet, as a search from Shodan shows, with the most devices located in Viet Nam. In October 2019, the Department of Commerce added Dahua to the “Entity List” which bans Dahua from conducting businesses in the United States because of security reasons. Despite this, tens of thousands of Dahua devices have been found connected to the internet in the US. The Intercept, in an article linked below, reported many American surveillance camera brands are actually using Dahua and other Chinese banned firmware to power their cameras. Owners of Dahua cameras are urged to update to the latest available firmware and change the default password with something unique and strong.