CVE-2021-33045
Estado: AnalizadaCrítica (9.8)⚠ Explotación activa
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 100%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 21/8/2024
- Plazo de remediación: 11/9/2024
- Uso conocido en ransomware: Unknown
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1078Valid Accountsstealth · persistence · privilege escalation · initial access90 % - Impacto secundario
T1005Data from Local Systemcollection75 % - Impacto secundario
T1565Data Manipulationimpact70 %
CVE crítica (AV:N/AC:L/PR:N) en dispositivos Dahua: bypass de autenticación mediante paquetes maliciosos (CWE-287) permite acceso sin credenciales válidas (T1078), lectura de datos de vigilancia (T1005) y potencial manipulación de grabaciones (T1565).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (18)
Dahuasecurity — Ipc-hum7xxx FirmwareDahuasecurity — Ipc-hx3xxx FirmwareDahuasecurity — Ipc-hx5xxx FirmwareDahuasecurity — Nvr-1xxx FirmwareDahuasecurity — Nvr-2xxx FirmwareDahuasecurity — Nvr-4xxx FirmwareDahuasecurity — Nvr-5xxx FirmwareDahuasecurity — Nvr-6xx FirmwareDahuasecurity — Vth-542xh FirmwareDahuasecurity — Vto-65xxx FirmwareDahuasecurity — Vto-75x95x FirmwareDahuasecurity — Xvr-4x04 FirmwareDahuasecurity — Xvr-4x08 FirmwareDahuasecurity — Xvr-5x04 FirmwareDahuasecurity — Xvr-5x08 FirmwareDahuasecurity — Xvr-5x16 FirmwareDahuasecurity — Xvr-7x16 FirmwareDahuasecurity — Xvr-7x32 Firmware
CWE
- CWE-287
- CWE-287
Referencias
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-33045",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-33045",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-05T15:03:50.889187Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@dahuatech.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Some Dahua IP Camera, Video Intercom, NVR, XVR devices",
"versions": [
{
"status": "affected",
"version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019."
}
]
}
]
}
],
"published": "2021-09-15T22:15:10.687",
"references": [
{
"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "http://seclists.org/fulldisclosure/2021/Oct/13",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
"tags": [
"Vendor Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2021/Oct/13",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
},
{
"lang": "es",
"value": "Una vulnerabilidad de omisión de autenticación de identidad encontrada en algunos productos Dahua durante el proceso de inicio de sesión. Los atacantes pueden omitir la autenticación de identidad del dispositivo al construir paquetes de datos maliciosos"
}
],
"lastModified": "2026-06-17T03:54:04.020",
"cisaActionDue": "2024-09-11",
"cisaExploitAdd": "2024-08-21",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0356805-3ECF-4C6F-B2BF-95D507736C44",
"versionEndExcluding": "2.820.0000000.5.r.210705"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5AE9ACB0-4CB3-4CF5-A007-15EE977D782E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0D17050-41CA-4808-8ED3-F332FD00B551",
"versionEndExcluding": "2.800.0000000.29.r.210630"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8936A118-4AB5-4B09-A9FD-E624A68315BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F20DC69-B735-4547-826D-E4C42A39FE82",
"versionEndExcluding": "2.820.0000000.5.r.210705"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F2838BDA-97FF-498E-BC81-955D31B9227A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA1C3935-C83B-4A1A-BEEE-EF93F7722972",
"versionEndExcluding": "4.001.0000005.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-1xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7780D1BE-ABE0-4890-B493-36FA0A4B3266"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "795EF8B2-5E6D-46EB-9F66-85F2C71B2619",
"versionEndExcluding": "4.001.0000000.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-2xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "89E3F7B3-3C51-49C1-BAEC-DA4235D5A06D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1386662B-C3DE-467A-8F41-F18BDE7B9726",
"versionEndExcluding": "4.001.0000005.1.r.210713"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-4xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "58ECDC49-09D4-4E62-AC11-E3C52C656A9D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06A6B28A-2E0D-4E45-904A-66FEE5D85262",
"versionEndExcluding": "4.001.0000000.0.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-5xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DE621958-8AE2-44E0-9E41-94BC964CDF57"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90D5A1B3-88D5-4E5E-A88B-59409D41956C",
"versionEndExcluding": "4.001.0000001.1.r.210716"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-6xx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9EEAC798-870E-4DE6-B7DB-44FAF5360CE5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F1138DD-7149-4191-BF6B-5176B8EF3A07",
"versionEndExcluding": "4.500.0000002.0.r.210715"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "72039FDA-344D-4961-BB1B-E6F32EAFD7C2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AC98964-DBDE-438C-A0E7-BF11D1BBC4B0",
"versionEndExcluding": "4.300.0000004.0.r.210715"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9438ADC0-C8F4-48E1-A905-9914A3AE715E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3FFF94A-7F57-49D2-A6BA-5B58064C41C5",
"versionEndExcluding": "4.300.0000003.0.r.210714"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B205125D-5A33-49B0-A2BA-BD833D107924"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BFB4B89-FD66-4A9E-9163-8E27730012C8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97031A47-9275-45CD-AFBB-A906A3A37D71"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83753916-EBB9-4378-9448-79B33EA851C7",
"versionEndExcluding": "4.001.0000001.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x08:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D6962025-38D1-4B8E-9C51-2806599F8779"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3D44B80-93EF-41AD-9BFD-B363CC8356CF",
"versionEndExcluding": "4.001.0000001.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97031A47-9275-45CD-AFBB-A906A3A37D71"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44FAD9FC-F99A-45DE-A8FA-031CD0F4680E",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F496B4C1-062B-4C6E-9F8C-C3B49D4D98EF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEAA6256-9F3D-43C7-858C-D07025EE5400",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x08:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AA245352-2E71-4401-AB16-1CA8D827D858"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C5D8D60-F5A5-42B2-830B-E4D89828988F",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "60F64F53-4C08-48A1-A3EB-F3EB5A1C0631"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22635FB9-7898-457B-938B-9946CFC9EE73",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-7x16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "95CC3087-2310-4520-8B69-4F21F6F78197"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D80CC1B-87EC-44BF-A453-A57350A4C061",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-7x32:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "06268CD6-0DFD-4501-9D4E-AA25E14B215E"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@dahuatech.com",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Dahua IP Camera Authentication Bypass Vulnerability"
}