CVE-2021-33044criticalunder attackCWE-287

CVE-2021-33044: critical vulnerability in Some Dahua IP Camera, Video Intercom, PTZ Dome…

Published · Updated

Follow this CVE+ Monitor IP Camera+ Monitor Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon26 days
Published on NVDSep 15
1st PoC+26d
CISA KEV+1071d
Action required by CISAfederal deadline: 2024-09-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Attackers can bypass the login authentication on some Dahua devices by sending specially crafted data packets, gaining unauthorized access without needing valid credentials.

Technical detail

An authentication bypass vulnerability in Dahua products allows remote attackers to circumvent identity verification during the login process through malformed packet construction, resulting in unauthorized access to device administration functions without pre-existing credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.