Dahua · IP Camera Firmware

CVE-2021-33045

Dahua IP Camera Authentication Bypass Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99.6%

What it is

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

CISA: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: September 11, 2024

Added to the CISA list: August 21, 2024
Published: September 15, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.6% in the top 0.1% of all known vulnerabilities
Weakness: CWE-287
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Dahua

Added	Vulnerability	Product	Severity	Attack chance
Aug 21, 2024	IP Camera Authentication BypassCVE-2021-33044	IP Camera Firmware	Critical 9.8	>99.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.