CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-33045
Critical (9.8) in Dahua IP Camera Firmware. In CISA KEV since 2024-08-21. EPSS 100% chance of exploitation in the next 30 days.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2024-08-21, due 2024-09-11
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dahuasecurity:ipc-hum7xxx_firmware
- dahuasecurity:ipc-hx3xxx_firmware
- dahuasecurity:ipc-hx5xxx_firmware
- dahuasecurity:nvr-1xxx_firmware
- dahuasecurity:nvr-2xxx_firmware
- dahuasecurity:nvr-4xxx_firmware
- dahuasecurity:nvr-5xxx_firmware
- dahuasecurity:nvr-6xx_firmware
- dahuasecurity:vth-542xh_firmware
- dahuasecurity:vto-65xxx_firmware
- dahuasecurity:vto-75x95x_firmware
- dahuasecurity:xvr-4x04_firmware
- dahuasecurity:xvr-4x08_firmware
- dahuasecurity:xvr-5x04_firmware
- dahuasecurity:xvr-5x08_firmware
- dahuasecurity:xvr-5x16_firmware
- dahuasecurity:xvr-7x16_firmware
- dahuasecurity:xvr-7x32_firmware
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13