Login Request a demo
Critical severity · published Sep 15, 2021
CVE-2021-33044
Dahua IP Camera Authentication Bypass Vulnerability
In wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 21, 2024
Federal remediation dueSep 11, 2024
Ransomware campaign useNot known
Affected products
Which versions
SD
Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices ·
Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021. · source: vendor
IF
Ipc-hum7xxx Firmware · Dahuasecurity
before 2.820.0000000.5.r.210705 · source: NVD
IF
Ipc-hx3xxx Firmware · Dahuasecurity
before 2.800.0000000.29.r.210630 · source: NVD
IF
Ipc-hx5xxx Firmware · Dahuasecurity
before 2.820.0000000.18.r.210705 · source: NVD
SF
Sd1a1 Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
SF
Sd22 Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
SF
Sd49 Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
SF
Sd50 Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
SF
Sd52c Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
SF
Sd6al Firmware · Dahuasecurity
before 2.812.0000007.0.r.210706 · source: NVD
TF
Tpc-bf1241 Firmware · Dahuasecurity
before 2.630.0000000.6.r.210707 · source: NVD
TF
Tpc-bf2221 Firmware · Dahuasecurity
before 2.630.0000000.10.r.210707 · source: NVD
Affected product
SD
Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33044
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33044
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.dahuasecurity.com/support/cybersecurity/details/957
mailing-list
http://seclists.org/fulldisclosure/2021/Oct/13
x_refsource_MISC
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html