← CVE Radar
CVE-2021-33045Dahua IP Camera Authentication Bypass Vulnerability
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
9.8 CRITICALEPSS 99.59%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Sep 11, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2021-33045
- Status
- Analyzed
- Assigner (CNA)
- dahua
- Published
- Sep 15, 2021
- Last modified
- 2026-06-17 03:54 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Some Dahua IP Camera, Video Intercom, NVR, XVR devices1 version range
- Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019.
References
- packetstormsecurity.com http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- seclists.org http://seclists.org/fulldisclosure/2021/Oct/13
- dahuasecurity.com https://www.dahuasecurity.com/support/cybersecurity/details/957
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045