NetSight
IP …
critical9.8Known exploited

CVE-2021-33045

Dahua IP Camera Authentication Bypass Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-08-21. Federal due date: 2024-09-11.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Affected products

VendorProductAffected versions
DahuasecurityIpc-Hum7xxx Firmware
before 2.820.0000000.5.r.210705
DahuasecurityIpc-Hx3xxx Firmware
before 2.800.0000000.29.r.210630
DahuasecurityIpc-Hx5xxx Firmware
before 2.820.0000000.5.r.210705
DahuasecurityNvr-1xxx Firmware
before 4.001.0000005.1.r.210709
DahuasecurityNvr-2xxx Firmware
before 4.001.0000000.1.r.210710
DahuasecurityNvr-4xxx Firmware
before 4.001.0000005.1.r.210713
DahuasecurityNvr-5xxx Firmware
before 4.001.0000000.0.r.210710
DahuasecurityNvr-6xx Firmware
before 4.001.0000001.1.r.210716
DahuasecurityVth-542xh Firmware
before 4.500.0000002.0.r.210715
DahuasecurityVto-65xxx Firmware
before 4.300.0000004.0.r.210715
DahuasecurityVto-75x95x Firmware
before 4.300.0000003.0.r.210714
DahuasecurityXvr-4x04 Firmware
All versions
before 4.001.0000001.1.r.210709

Weakness classification

CWE-287

References