VulnerabilityAnalyzed
CVE-2021-33045
Dahua IP Camera Authentication Bypass Vulnerability
KEVCRITICAL 9.8EPSS 99.6%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 11 September 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.56% probability · 100th percentile
- CISA KEV
- Listed 21 August 2024 · due 11 September 2024
- Weakness
- CWE-287
- Affected
- dahuasecurity/ipc-hum7xxx firmware · dahuasecurity/ipc-hx3xxx firmware · dahuasecurity/ipc-hx5xxx firmware · dahuasecurity/nvr-1xxx firmware · dahuasecurity/nvr-2xxx firmware · dahuasecurity/nvr-4xxx firmware · dahuasecurity/nvr-5xxx firmware · dahuasecurity/nvr-6xx firmware · dahuasecurity/vth-542xh firmware · dahuasecurity/vto-65xxx firmware · dahuasecurity/vto-75x95x firmware · dahuasecurity/xvr-4x04 firmware · dahuasecurity/xvr-4x08 firmware · dahuasecurity/xvr-5x04 firmware · dahuasecurity/xvr-5x08 firmware · dahuasecurity/xvr-5x16 firmware · dahuasecurity/xvr-7x16 firmware · dahuasecurity/xvr-7x32 firmware
- Source
- cybersecurity@dahuatech.com
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33045
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
- https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
- https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.