CVE-2021-33045
The identity authentication bypass vulnerability found in some Dahua products during the login...
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- Record
CVE-2021-33045- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- Record
CVE-2021-33045- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2021-19760
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- Record
EUVD-2021-19760- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9vwj-hj2h-whjq
The identity authentication bypass vulnerability found in some Dahua products during the login...
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- Record
GHSA-9vwj-hj2h-whjq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
CISA KEV No score
Dahua IP Camera Authentication Bypass Vulnerability
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
- Record
CVE-2021-33045- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- dahua ip camera firmware
- dahuasecurity ipc-hum7xxx firmware
- dahuasecurity ipc-hx3xxx firmware
- dahuasecurity ipc-hx5xxx firmware
- dahuasecurity nvr-1xxx firmware
- dahuasecurity nvr-2xxx firmware
- dahuasecurity nvr-4xxx firmware
- dahuasecurity nvr-5xxx firmware
- dahuasecurity nvr-6xx firmware
- dahuasecurity vth-542xh firmware
- dahuasecurity vto-65xxx firmware
- dahuasecurity vto-75x95x firmware
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dongpohezui/cve-2021-33045 | 2021-10-11 |
| Nuclei | Dahua IPC/VTH/VTO - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33045 is a critical vulnerability (CVSS 9.8) in Dahua Ip Camera Firmware, published September 15, 2021. CISA lists it as known to be exploited, since August 21, 2024. EUVD reports exploitation since August 21, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.6%, the 99th percentile. No source names a fixed version.
References
dahuasecurity.com/support/cybersecurity/details/957
seclists.org/fulldisclosure/2021/Oct/13
packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045
nvd.nist.gov/vuln/detail/CVE-2021-33045
github.com/advisories/GHSA-9vwj-hj2h-whjq