VulnerabilityAnalyzed
CVE-2021-33044
Dahua IP Camera Authentication Bypass Vulnerability
KEVCRITICAL 9.8EPSS 99.9%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 11 September 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.87% probability · 100th percentile
- CISA KEV
- Listed 21 August 2024 · due 11 September 2024
- Weakness
- CWE-287
- Affected
- dahuasecurity/ipc-hum7xxx firmware · dahuasecurity/ipc-hx3xxx firmware · dahuasecurity/ipc-hx5xxx firmware · dahuasecurity/sd1a1 firmware · dahuasecurity/sd22 firmware · dahuasecurity/sd49 firmware · dahuasecurity/sd50 firmware · dahuasecurity/sd52c firmware · dahuasecurity/sd6al firmware · dahuasecurity/tpc-bf1241 firmware · dahuasecurity/tpc-bf2221 firmware · dahuasecurity/tpc-bf5x01 firmware · dahuasecurity/tpc-pt8x21b firmware · dahuasecurity/tpc-sd2221 firmware · dahuasecurity/tpc-sd8x21 firmware · dahuasecurity/vto-65xxx firmware · dahuasecurity/vto-75x95x firmware · dahuasecurity/vth-542xh firmware · dahuasecurity/tpc-bf5x21 firmware
- Source
- cybersecurity@dahuatech.com
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33044
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
- https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
- https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.