CVE-2021-33045

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Some Dahua IP Camera, Video Intercom, NVR, XVR devices	Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019.

References

http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Oct/13Exploit, Mailing List, Third Party Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045US Government Resource

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 21, 2024
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-330469.8Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specif CVE-2021-33057.8Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.CVE-2021-330547.5SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with n CVE-2021-330559.8Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-330567.5Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.CVE-2021-330577.5The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo CVE-2021-330587.8Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may al CVE-2021-330596.7Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may CVE-2021-330607.8Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pr CVE-2021-330615.5Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially CVE-2021-330627.8Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticat CVE-2021-330637.8Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenti