Dahua p2pwn backdoor account creation (CVE-2024-39943)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•2•0•80

Detects network or system activity associated with the 'p2pwn' backdoor account on Dahua cameras, which is introduced by exploiting the CVE-2024-39943 vulnerability. The rule monitors for the presence of 'p2pwn' and 'p2password' strings across logs, including RPC/login events.