CVE-2021-33045

Timeline

Detection, updates, and resolution for this record.

1. Sep 15, 2021 · Catalog

   Detected

   The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

2. Aug 21, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Sep 11, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Affected

• cpe dahuasecurity/ipc-hum7xxx firmwareversion unspecified
• cpe dahuasecurity/ipc-hx3xxx firmwareversion unspecified
• cpe dahuasecurity/ipc-hx5xxx firmwareversion unspecified
• cpe dahuasecurity/nvr-1xxx firmwareversion unspecified
• cpe dahuasecurity/nvr-2xxx firmwareversion unspecified
• cpe dahuasecurity/nvr-4xxx firmwareversion unspecified
• cpe dahuasecurity/nvr-5xxx firmwareversion unspecified
• cpe dahuasecurity/nvr-6xx firmwareversion unspecified
• cpe dahuasecurity/vth-542xh firmwareversion unspecified
• cpe dahuasecurity/vto-65xxx firmwareversion unspecified
• cpe dahuasecurity/vto-75x95x firmwareversion unspecified
• cpe dahuasecurity/xvr-4x04 firmwareversion unspecified
• vendor Dahua IP Camera Firmwareversion unspecified

Sources

• CISA KEVCVE-2021-33045

  Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

  cisa.gov
• CVE.orgCVE-2021-33045

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-33045

  30-day exploitation probability 99.6%

  first.org
• NIST NVDCVE-2021-33045

  The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Exploit · seclists.org
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · dahuasecurity.com
• Vendor Advisory · dahuasecurity.com