Dahua web-enabled DVRs and rebranded versions do not enforce authentication on their administrative services. Included in this archive is the advisory and a metasploit module proof of concept exploit.
96d9b275b8fb781ce81072271e7c916990a3b1533948680e2de9477c048e9956