Lorex in the staff app: the answer / full research report

Source research for the answer page, converted verbatim. Labels and confidence levels are the researcher's own. Compiled 2026-10-06.

Lorex in the TRC staff app: research findings (2026-10-06)

Assumption: TRC's exact NVR and doorbell model numbers are unknown; nothing below names them. Every verdict is conditional on those numbers.

Verdict per capability

1. NVR local access

• FACT: Lorex documents the Dahua RTSP URL rtsp://user:pass@IP:554/cam/realmonitor?channel=N&subtype=0 (0 main, 1 sub). https://www.lorextechnology.com/downloads/security-nvr/NR810-Series/NR810_HTML_EN/sect1sect19.html ; https://lorex-help.freshdesk.com/support/solutions/articles/72000640829-ip-cameras-using-real-time-streaming-protocol-rtsp-with-your-dvr-nvr (high)
• FACT: Lorex says RTSP works only "with certain models of DVR / NVR's and IP cameras"; no list published. Same Lorex help URL. (high)
• FACT: Older LNK-series uses rtsp://IP:554/chNN/0 and RTSP must be enabled in Settings > Network > RTSP. https://www.lorextechnology.com/downloads/security-nvr/LNK7000-LS/manual/sect1sect13.html (high)
• FACT (third party): a few Lorex models (LNB2153, MCNB2153) run Hikvision firmware with /Streaming/Channels/101 paths. https://www.visioforge.com/help/docs/dotnet/camera-brands/lorex/ (moderate)
• SECONDHAND: Lorex support told a user "lorex NVRs are onvif compatible" (for adding cameras). https://community.home-assistant.io/t/lorex-nvr-integration-2024/762729 (moderate)
• FACT (third party): playback by time range: rtsp://user:pass@IP:554/cam/playback?channel=1&starttime=YYYY_MM_DD_HH_MM_SS&endtime=...; stated to apply to "newer Lorex" Dahua OEM recorders; shapes vary by firmware. https://djxsystems.com/insights/dahua-nvr-mp4-time-range-download ; https://community.home-assistant.io/t/rtsp-stream-url-play-via-mobile/968469 (moderate)
• SECONDHAND: Lorex 4K NVR main stream defaults to H.265; switching to H.264 fixed third-party playback. https://www.bensoftware.com/forum/discussion/2678/lorex-flir-lnr608-and-4k-stream-subtype (moderate). INFERENCE: set sub streams to H.264 for WebRTC/browser playback.
• FACT: Dahua sold Lorex to Skywatch; closed Feb 2023. https://sen.news/dahua-sells-lorex-for-us72-million/ (high)
• UNKNOWN: RTSP/ONVIF on Lorex Connect-generation recorders (N831, X/U/V series). Lorex has an ONVIF camera-add guide for U Series only; no RTSP-out statement found. https://apps.apple.com/us/app/-/id6504659499

2. Doorbells

• FACT: 2K wired doorbell = B451AJD / B451AJDB. Lorex: "This camera does not support the ONVIF protocol." App: Lorex Classic. 32GB microSD local. https://www.lorex.com/products/2k-wi-fi-video-doorbell-with-person-detection-wired (high)
• FACT: B451 can be added to a Fusion NVR (e.g. N910A62; N863A63B has 2 Fusion slots, N910 has 8) over the LAN; not to non-Fusion recorders. https://www.lorex.com/products/n910-dl-wireless-fusion-nvr-kit ; https://www.lorex.com/products/8-channel-nvr-fusion-system-with-four-4k-smart-deterrence-ip-dome-cameras-2k-wi-fi-video-doorbell-and-smart-sensor-starter-kit (high)
• SECONDHAND: B451 serves RTSP main+sub at /cam/realmonitor?channel=1&subtype=0|1, user admin, password = the one set in the Lorex app. https://ipcamtalk.com/threads/lorex-2k-doorbell.58885/page-2 ; https://github.com/baudneo/dahuavto2mqtt (moderate)
• SECONDHAND (June 2024): after the Skywatch firmware, RTSP still works but "Lorex (now) uses a different firmware and API and therefore it no longer works with the Dahua Addon." https://community.home-assistant.io/t/lorex-doorbell-since-dahua-sale/739270 (moderate)
• SECONDHAND: firmware 2.820 blocked port 5000 (event channel used by dahuavto2mqtt). https://ipcamtalk.com/threads/lorex-2k-doorbell.58885/page-3 ; Feb 2025: latest firmware "seems to block the http API". https://github.com/AlexxIT/go2rtc/issues/1594 (moderate)
• 4K wired doorbell = B862 series. SECONDHAND: not ONVIF but serves RTSP (https://ipcamtalk.com/threads/lorex-4k-doorbell.72926/). CONFLICT: Lorex Pro store lists a cloud-enabled 4K doorbell as ONVIF conformant (https://pro.lorex.com/products/b862-lorex-4k-wired-video-doorbell). (low)
• FACT: B463AJD is a 2K battery doorbell (https://www.adorama.com/lrxb463ajdbe.html). INFERENCE: battery units sleep between events; no constant RTSP. (low)
• FACT: Lorex's compare page lists four doorbells (4K wired, 2K wired, 2K battery, 1080p wired) under the Lorex Connect app label. https://www.lorex.com/pages/compare/doorbells (moderate; page content was partial)
• Two-way talk: SECONDHAND a Lorex 4K doorbell user hears and talks through Frigate/go2rtc WebRTC, with missing mic/speaker buttons on the HA card (https://community.home-assistant.io/t/2-way-audio-with-lorex-4k-doorbell-frigate-and-issues-with-webrtc-i-think/804182). A Lorex 2K user got 404 "wrong response on DESCRIBE" on the backchannel (https://github.com/AlexxIT/go2rtc/issues/1594). (low)
• FACT/SECONDHAND: a persistent go2rtc backchannel can disable the doorbell button; fix is #backchannel=0 on every stream except one. go2rtc docs: "Make sure not to request backchannel multiple times by adding #backchannel=0 to other stream sources of the same doorbell"; prefer unicast=true&proto=Onvif. https://go2rtc.org/internal/rtsp/ ; https://ipcamtalk.com/threads/lorex-2k-doorbell.58885/page-3 (moderate)
• Ring events: dbhardman/Lorex_doorbell (B451AJD-F) and dahuavto2mqtt deliver ring events but rely on Dahua event ports that later firmware closed. https://github.com/dbhardman/Lorex_doorbell (moderate)

3. Lorex cloud, apps, libraries

• No public/partner API for Lorex cloud found; 2026 review notes limited ONVIF and no native HA/HomeKit. pvrblog.com/brands/lorex (archive copy; live page returned 404 on 10/6) (moderate, absence of evidence)
• FACT: three app lines. Lorex Connect = new U/V/X series, N831, FL301/SL301/IC501. Lorex Classic (formerly Lorex Home) = Fusion NVRs, Wi-Fi cams, doorbells. Lorex Cloud / Lorex Pro = wired DVR/NVR (e.g. 881-series); "Lorex Cloud" is an app name, recordings stay local. https://www.lorex.com/pages/lorex-apps ; https://www.lorex.com/pages/lorex-cloud-app ; https://apps.apple.com/us/app/lorex-classic/id1342829120 (high)
• Libraries (all Dahua-based): rroller/dahua (HACS; lists Lorex E891AB/E893DD, LNB8005-C, LNE8964AB; doorbell press events; warns "some doorbells whose firmware moved to the cloud app, serve no /cgi-bin/ API") https://github.com/rroller/dahua ; forks https://github.com/Tom-Sumner/dahua-lorex , https://github.com/mentalisit/lorex ; https://github.com/dbhardman/Lorex_doorbell ; https://github.com/baudneo/dahuavto2mqtt (high)
• SECONDHAND: HA users mostly use the Generic Camera integration with the NVR RTSP URL; one says the Dahua integration "worked until July and after that it stopped working." https://community.home-assistant.io/t/lorex-nvr-integration-2024/762729 (moderate)
• FACT: Videoloft supports Lorex via Dahua's API. https://videoloft.com/lorex-cloud-storage/ (moderate)

4. Delivery architecture and Expo packages

• go2rtc: RTSP in; WebRTC, HLS, MSE/MP4, MJPEG, RTSP out; built-in web UI on :1984; Dahua two-way audio; warns "If an attacker gains access to the API, you are in danger"; recommends a reverse proxy. https://github.com/AlexxIT/go2rtc (high)
• Pending go2rtc PR #2431 adds native Dahua talk over TCP/37777. https://github.com/AlexxIT/go2rtc/pull/2431 (moderate, unmerged)
• Alternatives: MediaMTX (RTSP to WebRTC/HLS), Scrypted (a Lorex 4K doorbell user picked its RTSP plugin because audio works, https://ipcamtalk.com/threads/lorex-4k-doorbell.72926/), Frigate (bundles go2rtc, adds person detection). (moderate)
• expo-video plays HLS on iOS if the URI ends .m3u8 or contentType is 'hls'; caching does not work with HLS on iOS. https://docs.expo.dev/versions/latest/sdk/video/ (high)
• react-native-webrtc needs @config-plugins/react-native-webrtc and a dev/production native build; not Expo Go. https://www.daily.co/blog/deploying-webrtc-on-an-expo-react-native-app-2/ (high)
• INFERENCE: an OTA JS-only release is possible only if expo-video or react-native-webview is already in the shipped binary; otherwise a new App Store build. WebRTC talk always needs a new binary. Repos not inspected.

Recommended stack (INFERENCE): 1. Office LAN host (always-on Mac mini or Linux box) runs go2rtc; sources = NVR sub streams (H.264) for live, main streams on demand, doorbell RTSP with #backchannel=0 except the one talk source. Host joins Tailscale. 2. Door backend (agents.therecording.club) joins the tailnet via sidecar; reverse-proxies go2rtc's HLS / MSE-WebSocket / WebRTC signaling behind staff auth, short-lived signed URLs, per-role camera allowlist; proxies /cam/playback time-range requests (or ffmpeg-exports MP4 clips) for playback. 3. Web (staff.therecording.club): go2rtc's MSE/WebRTC player via the proxy. 4. iOS: expo-video with HLS for live and playback (fastest path: WebView of the proxied go2rtc player). Two-way talk later via react-native-webrtc in a new build. 5. Ring push: test the doorbell's local event ports first; if closed, use person detection on the doorbell stream (Frigate) as a stand-in, or swap to a Dahua-native doorbell such as Amcrest AD410, which still works with the Dahua integration (https://community.home-assistant.io/t/lorex-doorbell-since-dahua-sale/739270).

5. Identify the NVR model and enable RTSP

• Model label: sticker on the recorder's underside/back; also the System Information screen on the NVR's local menu; also device info in whichever Lorex app the staff use (the app itself tells the line: Classic = Fusion, Cloud/Pro = wired, Connect = new generation). https://www.lorex.com/pages/lorex-apps (moderate; label location is general practice)
• Enable RTSP: LNK-series: Settings > Network > RTSP tab > RTSP Enable + Verify > Save. https://www.lorextechnology.com/downloads/security-nvr/LNK7000-LS/manual/sect1sect13.html (high). Dahua-based series: RTSP is on by default on port 554 per the NR810 manual section. (moderate)
• Firmware: newer recorders: Main Menu > System > Update & Reset > Upgrade; manual firmware is by calling Lorex at 1-888-425-6739. https://www.lorex.com/blogs/help/dvr-nvr-how-to-manually-upgrade-the-firmware-of-your-recorder (moderate). INFERENCE: block the NVR/doorbell from auto-updating once working, since updates have removed local APIs.
• On-site probe, run from a machine on the office LAN:

nmap -p 80,554,5000,35000,37777 <NVR_IP> <DOORBELL_IP>
ffprobe "rtsp://admin:PASS@<NVR_IP>:554/cam/realmonitor?channel=1&subtype=1"
ffprobe "rtsp://admin:PASS@<DOORBELL_IP>:554/cam/realmonitor?channel=1&subtype=1"

6. Security

• FACT: Dahua auth bypass CVE-2021-33044/33045 on CISA KEV since 2024-08-21. https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog (high)
• SECONDHAND: 14,500+ Dahua devices compromised June to July 2026 via credentials, these bypasses and P2P relay. https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html (high)
• Recommendation: never port-forward 554/80/37777; no public go2rtc; tailnet-only between office host and door backend; consider disabling the NVR's P2P cloud if staff no longer need the Lorex app (trade-off: Lorex app stops working remotely); dedicated read-only NVR user for the stream host.

Effort estimate (INFERENCE, low confidence)

Blockers

• On-site access: model labels, NVR admin password, a LAN host to run go2rtc.
• Connect-generation recorder may expose no RTSP.
• Doorbell firmware may have closed the event/HTTP API; auto-updates can break a working setup.
• A new iOS binary if expo-video/WebView/WebRTC are not already shipped.

Open questions (need exact models)

1. NVR model and firmware; which Lorex app staff use (answers Fusion vs wired vs Connect).
2. Doorbell model (B451 / B862 / battery B463 / other) and firmware; is it on the NVR as a Fusion channel or app-only?
3. Do ports 554, 5000, 35000, 37777 answer on the doorbell?
4. Does a Fusion-attached doorbell pass ring events to the NVR's event stream?
5. Is the 4K doorbell ONVIF (sources conflict)?
6. Does the shipped staff app binary already include expo-video or react-native-webview?