← CVE Radar
CVE-2021-33044Dahua IP Camera Authentication Bypass Vulnerability
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
9.8 CRITICALEPSS 99.98%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Sep 11, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2021-33044
- Status
- Analyzed
- Assigner (CNA)
- dahua
- Published
- Sep 15, 2021
- Last modified
- 2026-06-17 03:54 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices1 version range
- Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.
References
- packetstormsecurity.com http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- seclists.org http://seclists.org/fulldisclosure/2021/Oct/13
- dahuasecurity.com https://www.dahuasecurity.com/support/cybersecurity/details/957
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044