Login Request a demo
Critical severity · published Sep 15, 2021
CVE-2021-33045
Dahua IP Camera Authentication Bypass Vulnerability
In wildKEV
9.8
CVSS
99.6%
EPSS
Yes
On KEV
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 21, 2024
Federal remediation dueSep 11, 2024
Ransomware campaign useNot known
Affected products
Which versions
SD
Some Dahua IP Camera, Video Intercom, NVR, XVR devices ·
Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019. · source: vendor
IF
Ipc-hum7xxx Firmware · Dahuasecurity
before 2.820.0000000.5.r.210705 · source: NVD
IF
Ipc-hx3xxx Firmware · Dahuasecurity
before 2.800.0000000.29.r.210630 · source: NVD
IF
Ipc-hx5xxx Firmware · Dahuasecurity
before 2.820.0000000.5.r.210705 · source: NVD
NF
Nvr-1xxx Firmware · Dahuasecurity
before 4.001.0000005.1.r.210709 · source: NVD
NF
Nvr-2xxx Firmware · Dahuasecurity
before 4.001.0000000.1.r.210710 · source: NVD
NF
Nvr-4xxx Firmware · Dahuasecurity
before 4.001.0000005.1.r.210713 · source: NVD
NF
Nvr-5xxx Firmware · Dahuasecurity
before 4.001.0000000.0.r.210710 · source: NVD
NF
Nvr-6xx Firmware · Dahuasecurity
before 4.001.0000001.1.r.210716 · source: NVD
VF
Vth-542xh Firmware · Dahuasecurity
before 4.500.0000002.0.r.210715 · source: NVD
VF
Vto-65xxx Firmware · Dahuasecurity
before 4.300.0000004.0.r.210715 · source: NVD
VF
Vto-75x95x Firmware · Dahuasecurity
before 4.300.0000003.0.r.210714 · source: NVD
Affected product
SD
Some Dahua IP Camera, Video Intercom, NVR, XVR devices
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33045
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.dahuasecurity.com/support/cybersecurity/details/957
mailing-list
http://seclists.org/fulldisclosure/2021/Oct/13
x_refsource_MISC
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html