Every CVE Search/ Get API key

CVE-2021-33044

The identity authentication bypass vulnerability found in some Dahua products during the login...

9.8 CriticalIn KEVPublic exploit

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.6 points since Sep 16, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Record
CVE-2021-33044
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-287
Updated
2026-11-02
CVE List 9.8

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Record
CVE-2021-33044
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2021-19759 9.8

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Record
EUVD-2021-19759
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h2j4-m7qg-8m4g 9.8

The identity authentication bypass vulnerability found in some Dahua products during the login...

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Record
GHSA-h2j4-m7qg-8m4g
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
CISA KEV No score

Dahua IP Camera Authentication Bypass Vulnerability

Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

Record
CVE-2021-33044
Weakness
CWE-287
Updated
2026-11-02

Affected products

Show 8 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbp2008/DahuaLoginBypass2021-10-11
PoC in GitHubSpy0x7/CVE-2021-330442021-10-18
PoC in GitHubhaingn/LoHongCam-CVE-2021-330442023-10-22
PoC in GitHubBaza-NATO/CVE-2021-330442026-01-25
PoC in GitHubumair-aziz025/dahua-cve-research2026-03-03
PoC in GitHubeagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-330442026-03-24
PoC in GitHublitndat/Camera-Dahua-Research-l-h-ng-CVE-2021-330442026-06-24
NucleiDahua IPC/VTH/VTO - Authentication Bypass

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33044 is a critical vulnerability (CVSS 9.8) in Dahua Ip Camera Firmware, published September 15, 2021. CISA lists it as known to be exploited, since August 21, 2024. EUVD reports exploitation since August 21, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open