CVEvulnerability

CVE-2021-33045

9.8 CRITICAL Known exploited Published 2021-09-15 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Dahua IP Camera Authentication Bypass Vulnerability — Dahua IP Camera Firmware

Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

Added to KEV
2024-08-21
Remediation due
2024-09-11
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33045
Status
Analyzed
Published
2021-09-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-287

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Affected configurations

• dahuasecurity ipc-hum7xxx firmware (< 2.820.0000000.5.r.210705) • dahuasecurity ipc-hx3xxx firmware (< 2.800.0000000.29.r.210630) • dahuasecurity ipc-hx5xxx firmware (< 2.820.0000000.5.r.210705) • dahuasecurity nvr-1xxx firmware (< 4.001.0000005.1.r.210709) • dahuasecurity nvr-2xxx firmware (< 4.001.0000000.1.r.210710) • dahuasecurity nvr-4xxx firmware (< 4.001.0000005.1.r.210713) • dahuasecurity nvr-5xxx firmware (< 4.001.0000000.0.r.210710) • dahuasecurity nvr-6xx firmware (< 4.001.0000001.1.r.210716) • dahuasecurity vth-542xh firmware (< 4.500.0000002.0.r.210715) • dahuasecurity vto-65xxx firmware (< 4.300.0000004.0.r.210715) • dahuasecurity vto-75x95x firmware (< 4.300.0000003.0.r.210714) • dahuasecurity xvr-4x04 firmware • dahuasecurity xvr-4x08 firmware (< 4.001.0000001.1.r.210709) • dahuasecurity xvr-4x04 firmware (< 4.001.0000001.1.r.210709) • dahuasecurity xvr-5x04 firmware (< 4.001.0000003.1.r.210710) • dahuasecurity xvr-5x08 firmware (< 4.001.0000003.1.r.210710) • dahuasecurity xvr-5x16 firmware (< 4.001.0000003.1.r.210710) • dahuasecurity xvr-7x16 firmware (< 4.001.0000003.1.r.210710) • dahuasecurity xvr-7x32 firmware (< 4.001.0000003.1.r.210710)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References