CVE-2021-33045criticalunder attackCWE-287

CVE-2021-33045: critical vulnerability in Some Dahua IP Camera, Video Intercom, NVR, XVR…

Published · Updated

Follow this CVE+ Monitor IP Camera+ Monitor Some Dahua IP Camera, Video Intercom, NVR, XVR devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon26 days
Published on NVDSep 15
1st PoC+26d
CISA KEV+1071d
Action required by CISAfederal deadline: 2024-09-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Dahua devices have a critical flaw in their login process that allows attackers to bypass authentication by sending specially crafted data packets, potentially gaining unauthorized access to the device.

Technical detail

An authentication bypass vulnerability exists in Dahua product login mechanisms (CWE-287) where improper identity verification allows attackers to craft malicious packets to circumvent authentication checks without valid credentials. The remote, unauthenticated attack vector enables full device compromise with no user interaction required.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Some Dahua IP Camera, Video Intercom, NVR, XVR devices
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.