CVE-2021-33044

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices	Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.

References

http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044US Government Resource

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 21, 2024
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-330459.8The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity CVE-2021-330469.8Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specif CVE-2021-33057.8Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.CVE-2021-330547.5SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with n CVE-2021-330559.8Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-330567.5Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.CVE-2021-330577.5The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo CVE-2021-330587.8Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may al CVE-2021-330596.7Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may CVE-2021-330607.8Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pr CVE-2021-330615.5Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially CVE-2021-330627.8Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticat