ZHEJIANG DAHUA TECHNOLOGYCO.,LTD — 4 prefixes (MA-L)

This OUI entry maps to the exact IEEE registration string "ZHEJIANG DAHUA TECHNOLOGYCO.,LTD" — note the missing space before "CO", which slugifies differently from the more common "Zhejiang Dahua Technology Co., Ltd." spelling and is a distinct registry name string. Four MA-L blocks carry this name: 407AA4, F8CE07, 4C99E8, and 30DDAA, all listed at the company's newer registry address on No. 1399 Binxing Road, Binjiang District, Hangzhou (postal 311200) — separate from the larger pool of prefixes under the spaced name variant at the older No. 1199 address. Behind both name strings is one company: Dahua Technology (dahuasecurity.com), a Chinese video-surveillance and AIoT hardware maker founded in 2001, one of the world's largest by camera volume. Its hardware identity is video-centric: IP, PTZ, fisheye, and HDCVI cameras plus NVR/DVR/XVR recorders, with access control, intercoms, alarm panels, and networking gear alongside. For network defenders the vendor carries unusual weight. Dahua devices have a long public exploitation history — the 2016 BASHLITE/Mirai-era botnets, a 2017 remote-credential backdoor, the 2021 authentication bypass (CVE-2021-33044/33045, added to CISA's KEV catalog in 2024), and 2025 unauthenticated RCE flaws (CVE-2025-31700/31701) across 126 camera models — and the company is simultaneously on the U.S. Entity List, NDAA Section 889 procurement ban, and the FCC's covered-equipment list. Identifying a Dahua OUI on a network is therefore a meaningful asset-classification and risk signal, and the standard guidance is to isolate these devices on a no-internet IoT VLAN.

IEEE assignment

4 prefixes → ZHEJIANG DAHUA TECHNOLOGYCO.,LTD, Hangzhou, Zhejiang, CN [Confirmed] — IEEE MA-L

Registry / block size

MA-L (24-bit OUI). Four blocks under this exact name string: 407AA4, F8CE07, 4C99E8, 30DDAA [Confirmed] — IEEE MA-L. The broader "Dahua" footprint across all name variants is ~27 prefixes per maclookup.app aggregate [Likely] — maclookup.app (third-party snapshot, drifts).

Registry address / country

1st Floor, Building 1, No. 1399, Binxing Road, Changhe Street, Binjiang District, Hangzhou City, Zhejiang Province, CN 311200 [Confirmed] — IEEE MA-L. (Distinct from the older No. 1199 Bin'an / Waterfront Road address, postal 310053, used by the spaced "Zhejiang Dahua Technology Co., Ltd." name variant.)

Canonical company name

Zhejiang Dahua Technology Co., Ltd. (brand: Dahua Technology / Dahua Security) [Confirmed] — dahuasecurity.com, en.wikipedia.org/wiki/Dahua_Technology

Company status

active; founded 2001; >23,000 employees (2023), revenue ~$4.98B USD (2021) [Confirmed] — en.wikipedia.org/wiki/Dahua_Technology

Device types

IP/network cameras, PTZ, fisheye, HDCVI cameras; NVR/DVR/XVR recorders; access control & time-attendance terminals; video intercoms; alarm systems; network switches, APs, routers; LED displays/signage; intelligent traffic systems

[Confirmed] — dahuasecurity.com, en.wikipedia.org/wiki/Dahua_Technology

Industry

video surveillance / AIoT security hardware [Confirmed] — dahuasecurity.com

Allocation / registration date

Unknown — IEEE publishes NO assignment date for MAC/OUI blocks (the IEEE MA-L registry columns are only Registry, Assignment, Organization Name, Organization Address). Third-party "date registered" values on MAC-lookup sites (e.g., maclookup.app shows 2024-07-19 for 30:DD:AA, 2024-01-23 for F8:CE:07, 2025-01-07 for 4C:99:E8, 2025-04-24 for 40:7A:A4) are database artifacts, NOT IEEE facts, and are not recorded here as a registration date.

[Confirmed null] — IEEE the IEEE MA-L registry, maclookup.app

Security context

high-risk vendor. BASHLITE botnet (~1M devices, 2016); remote-credential backdoor (2017); auth-bypass CVE-2021-33044 / CVE-2021-33045 (30+ models, added to CISA KEV Aug 2024); unauthenticated RCE CVE-2025-31700 & CVE-2025-31701 (CVSS 8.1, 126 camera models; patched Jul 7 2025, disclosed Jul 30 2025); CVE-2025-31703 local serial-port priv-esc on NVR/XVR (patched Mar 2026).

[Confirmed] — thehackernews.com, securityaffairs.com, dahuasecurity.com PSIRT, en.wikipedia.org/wiki/Dahua_Technology

Regulatory status

U.S. BIS Entity List since Oct 2019; NDAA §889 federal-procurement ban (FY2019); FCC covered-equipment / new-authorization ban (Nov 2022, upheld Apr 2024). Named in the Secure Equipment Act. [Confirmed] — en.wikipedia.org/wiki/Dahua_Technology, ipvm.com, blink.ucsd.edu/technology/security/ndaa

IANA Reference

not applicable — OUI/MAC vendor entries have no IANA reference. [Confirmed — N/A]

Analyst note

Both "ZHEJIANG DAHUA TECHNOLOGYCO.,LTD" and the spaced variant resolve to the same company; a Dahua OUI reliably flags Dahua hardware and is a notable risk/compliance signal given the CVE history and U.S. bans. Recommended posture: isolate on an IoT VLAN with no inbound/outbound internet exposure and keep firmware current.