{"id":"CVE-2021-33045","aliases":["EUVD-2021-19760","GHSA-9vwj-hj2h-whjq"],"status":"published","title":"The identity authentication bypass vulnerability found in some Dahua products during the login...","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.99593,"percentile":0.99947,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2021-09-15T21:50:08Z","modified":"2026-06-17T03:54:04Z","kev":{"date_added":"2024-08-21","due_date":"2024-09-11","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-08-21"},{"source":"kev","since":"2024-08-21"}],"exploits":[{"source":"pocgithub","id":"dongpohezui/cve-2021-33045","title":"dongpohezui/cve-2021-33045","date":"2021-10-11","url":"https://github.com/dongpohezui/cve-2021-33045"},{"source":"nuclei","id":"CVE-2021-33045","title":"Dahua IPC/VTH/VTO - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33045.yaml"}],"products":[{"vendor":"dahua","product":"ip camera firmware"},{"vendor":"dahuasecurity","product":"ipc-hum7xxx_firmware"},{"vendor":"dahuasecurity","product":"ipc-hx3xxx_firmware"},{"vendor":"dahuasecurity","product":"ipc-hx5xxx_firmware"},{"vendor":"dahuasecurity","product":"nvr-1xxx_firmware"},{"vendor":"dahuasecurity","product":"nvr-2xxx_firmware"},{"vendor":"dahuasecurity","product":"nvr-4xxx_firmware"},{"vendor":"dahuasecurity","product":"nvr-5xxx_firmware"},{"vendor":"dahuasecurity","product":"nvr-6xx_firmware"},{"vendor":"dahuasecurity","product":"vth-542xh_firmware"},{"vendor":"dahuasecurity","product":"vto-65xxx_firmware"},{"vendor":"dahuasecurity","product":"vto-75x95x_firmware"},{"vendor":"dahuasecurity","product":"xvr-4x04_firmware"},{"vendor":"dahuasecurity","product":"xvr-4x08_firmware"},{"vendor":"dahuasecurity","product":"xvr-5x04_firmware"},{"vendor":"dahuasecurity","product":"xvr-5x08_firmware"},{"vendor":"dahuasecurity","product":"xvr-5x16_firmware"},{"vendor":"dahuasecurity","product":"xvr-7x16_firmware"},{"vendor":"dahuasecurity","product":"xvr-7x32_firmware"}],"references":[{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/957","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/13","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33045"},{"url":"https://github.com/advisories/GHSA-9vwj-hj2h-whjq"}],"sources":{"cve":[{"id":"CVE-2021-33045","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T21:50:08Z","modified":"2026-01-12T19:53:51.321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-19760","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T21:50:08Z","modified":"2026-01-12T19:53:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-08-21","updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-9vwj-hj2h-whjq","title":"The identity authentication bypass vulnerability found in some Dahua products during the login...","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2022-05-24T19:14:53Z","modified":"2025-10-22T00:32:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2021-33045","title":"Dahua IP Camera Authentication Bypass Vulnerability","description":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.","cwes":["CWE-287"],"kev":{"date_added":"2024-08-21","due_date":"2024-09-11","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-33045","description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","status":"published","published":"2021-09-15T22:15:10.687Z","modified":"2026-06-17T03:54:04.02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:58.502206Z"}]}}