{"id":"CVE-2021-33044","aliases":["EUVD-2021-19759","GHSA-h2j4-m7qg-8m4g"],"status":"published","title":"The identity authentication bypass vulnerability found in some Dahua products during the login...","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.99989,"percentile":0.99984,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2021-09-15T21:36:04Z","modified":"2026-06-17T03:54:03Z","kev":{"date_added":"2024-08-21","due_date":"2024-09-11","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-08-21"},{"source":"kev","since":"2024-08-21"}],"exploits":[{"source":"pocgithub","id":"bp2008/DahuaLoginBypass","title":"bp2008/DahuaLoginBypass","date":"2021-10-11","url":"https://github.com/bp2008/DahuaLoginBypass"},{"source":"pocgithub","id":"Spy0x7/CVE-2021-33044","title":"Spy0x7/CVE-2021-33044","date":"2021-10-18","url":"https://github.com/Spy0x7/CVE-2021-33044"},{"source":"pocgithub","id":"haingn/LoHongCam-CVE-2021-33044","title":"haingn/LoHongCam-CVE-2021-33044","date":"2023-10-22","url":"https://github.com/haingn/LoHongCam-CVE-2021-33044"},{"source":"pocgithub","id":"Baza-NATO/CVE-2021-33044","title":"Baza-NATO/CVE-2021-33044","date":"2026-01-25","url":"https://github.com/Baza-NATO/CVE-2021-33044"},{"source":"pocgithub","id":"umair-aziz025/dahua-cve-research","title":"umair-aziz025/dahua-cve-research","date":"2026-03-03","url":"https://github.com/umair-aziz025/dahua-cve-research"},{"source":"pocgithub","id":"eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044","title":"eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044","date":"2026-03-24","url":"https://github.com/eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044"},{"source":"pocgithub","id":"litndat/Camera-Dahua-Research-l-h-ng-CVE-2021-33044","title":"litndat/Camera-Dahua-Research-l-h-ng-CVE-2021-33044","date":"2026-06-24","url":"https://github.com/litndat/Camera-Dahua-Research-l-h-ng-CVE-2021-33044"},{"source":"nuclei","id":"CVE-2021-33044","title":"Dahua IPC/VTH/VTO - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33044.yaml"}],"products":[{"vendor":"dahua","product":"ip camera firmware"},{"vendor":"dahuasecurity","product":"ipc-hum7xxx_firmware"},{"vendor":"dahuasecurity","product":"ipc-hx3xxx_firmware"},{"vendor":"dahuasecurity","product":"ipc-hx5xxx_firmware"},{"vendor":"dahuasecurity","product":"sd1a1_firmware"},{"vendor":"dahuasecurity","product":"sd22_firmware"},{"vendor":"dahuasecurity","product":"sd49_firmware"},{"vendor":"dahuasecurity","product":"sd50_firmware"},{"vendor":"dahuasecurity","product":"sd52c_firmware"},{"vendor":"dahuasecurity","product":"sd6al_firmware"},{"vendor":"dahuasecurity","product":"tpc-bf1241_firmware"},{"vendor":"dahuasecurity","product":"tpc-bf2221_firmware"},{"vendor":"dahuasecurity","product":"tpc-bf5x01_firmware"},{"vendor":"dahuasecurity","product":"tpc-bf5x21_firmware"},{"vendor":"dahuasecurity","product":"tpc-pt8x21b_firmware"},{"vendor":"dahuasecurity","product":"tpc-sd2221_firmware"},{"vendor":"dahuasecurity","product":"tpc-sd8x21_firmware"},{"vendor":"dahuasecurity","product":"vth-542xh_firmware"},{"vendor":"dahuasecurity","product":"vto-65xxx_firmware"},{"vendor":"dahuasecurity","product":"vto-75x95x_firmware"}],"references":[{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/957","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/13","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33044"},{"url":"https://github.com/advisories/GHSA-h2j4-m7qg-8m4g"}],"sources":{"cve":[{"id":"CVE-2021-33044","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T21:36:04Z","modified":"2026-01-12T19:53:16.325Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-19759","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T21:36:04Z","modified":"2026-01-12T19:53:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-08-21","updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-h2j4-m7qg-8m4g","title":"The identity authentication bypass vulnerability found in some Dahua products during the login...","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2022-05-24T19:14:53Z","modified":"2025-10-22T00:32:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2021-33044","title":"Dahua IP Camera Authentication Bypass Vulnerability","description":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.","cwes":["CWE-287"],"kev":{"date_added":"2024-08-21","due_date":"2024-09-11","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-33044","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T22:15:10.497Z","modified":"2026-06-17T03:54:03.827Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:58.502206Z"}]}}