CVE-2021-33046

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Access control vulnerability found in some Dahua products	Dahua IP Camera devices IPC-HX3XXX, and IPC-HX5XXX; PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL; Thermal TPC-BF1241,TPC-BF2221, TPC-SD2221; VTO2101E, VTOX221E, and ASC2204C devices Buildtime between 2017/7 ~ 2021/7. NVR devices NVR4XXX, and NVR5XXX; XVR devices XVR4XXX, and XVR5XXX; HCVR devices HCVR7XXX, and HCVR8XXX devices Buildtime between 2017/1 ~ 2021/7.

References

https://support.dahuatech.com/networkSecurity/securityDetails?id=95Vendor Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Not Applicable
https://www.dahuasecurity.com/support/cybersecurity/details/987Vendor Advisory
https://support.dahuatech.com/networkSecurity/securityDetails?id=95Vendor Advisory
https://www.dahuasecurity.com/support/cybersecurity/details/957Not Applicable
https://www.dahuasecurity.com/support/cybersecurity/details/987Vendor Advisory

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-33057.8Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.CVE-2021-330547.5SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with n CVE-2021-330559.8Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-330567.5Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.CVE-2021-330577.5The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo CVE-2021-330587.8Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may al CVE-2021-330596.7Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may CVE-2021-330607.8Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pr CVE-2021-330615.5Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially CVE-2021-330627.8Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticat CVE-2021-330637.8Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenti CVE-2021-330647.8Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potential