CVE-2021-33045 is a critical authentication bypass vulnerability affecting various Dahua products, including IP cameras, VTH, and VTO devices. Attackers can exploit this flaw by crafting malicious data packets during the login process, bypassing identity authentication. With a CVSS score of 9.8 (Critical) and an EPSS score of 0.94171, this vulnerability is easily exploitable over the network with no user interaction, allowing for complete compromise of confidentiality, integrity, and availability. It is actively exploited in the wild and has garnered significant community attention, though no Metasploit or ExploitDB modules are publicly available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.820.0000000.5.r.210705CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:* | ||
< 2.800.0000000.29.r.210630CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:* | ||
< 2.820.0000000.5.r.210705CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:* | ||
< 4.001.0000005.1.r.210709CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:* | ||
< 4.001.0000000.1.r.210710CPE matchmatch criteria | cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.