Junglewise Threat Intelligence

CVE-2021-33045: Dahua IP Camera Authentication Bypass Vulnerability

CVE-2021-33045 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-08-21

Vendors: Dahua.

Executive brief

An authentication bypass vulnerability exists in several Dahua IP cameras and NVR products during the login process. Attackers can bypass identity authentication by constructing malicious data packets, specifically when a loopback device is specified by the client during authentication.

Affected products

  • Dahua IPC-HUM7XXX Firmware before 2.820.0000000.5.r.210705
  • Dahua IPC-HX3XXX Firmware before 2.800.0000000.29.r.210630
  • Dahua IPC-HX5XXX Firmware before 2.820.0000000.5.r.210705
  • Dahua NVR-1XXX Firmware before 4.001.0000005.1.r.210709
  • Dahua NVR-2XXX Firmware before 4.001.0000000.1.r.210710
  • Dahua NVR-4XXX Firmware before 4.001.0000005.1.r.210713
  • Dahua NVR-5XXX Firmware before 4.001.0000000.0.r.210710

Timeline

  • 2021-09-30: disclosed: Initial NVD analysis and vendor advisory published
  • 2024-08-21: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2024-08-21: exploited: Confirmed exploited in the wild per CISA KEV catalog

Related threats