CVE-2021-33045
Status: AnalyzedCritical (9.8)⚠ Active exploitation
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 100%
- Percentile among all scored CVEs: 100
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
CISA KEV — actively exploited
- Added to catalog: 8/21/2024
- Remediation due date: 9/11/2024
- Known ransomware use: Unknown
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access95 % - Primary impact
T1078Valid Accountsstealth · persistence · privilege escalation · initial access90 % - Secondary impact
T1005Data from Local Systemcollection75 % - Secondary impact
T1565Data Manipulationimpact70 %
CVE crítica (AV:N/AC:L/PR:N) en dispositivos Dahua: bypass de autenticación mediante paquetes maliciosos (CWE-287) permite acceso sin credenciales válidas (T1078), lectura de datos de vigilancia (T1005) y potencial manipulación de grabaciones (T1565).
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (18)
Dahuasecurity — Ipc-hum7xxx FirmwareDahuasecurity — Ipc-hx3xxx FirmwareDahuasecurity — Ipc-hx5xxx FirmwareDahuasecurity — Nvr-1xxx FirmwareDahuasecurity — Nvr-2xxx FirmwareDahuasecurity — Nvr-4xxx FirmwareDahuasecurity — Nvr-5xxx FirmwareDahuasecurity — Nvr-6xx FirmwareDahuasecurity — Vth-542xh FirmwareDahuasecurity — Vto-65xxx FirmwareDahuasecurity — Vto-75x95x FirmwareDahuasecurity — Xvr-4x04 FirmwareDahuasecurity — Xvr-4x08 FirmwareDahuasecurity — Xvr-5x04 FirmwareDahuasecurity — Xvr-5x08 FirmwareDahuasecurity — Xvr-5x16 FirmwareDahuasecurity — Xvr-7x16 FirmwareDahuasecurity — Xvr-7x32 Firmware
CWEs
- CWE-287
- CWE-287
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045
Raw JSON (NVD)
Show
{
"id": "CVE-2021-33045",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-33045",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-05T15:03:50.889187Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@dahuatech.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Some Dahua IP Camera, Video Intercom, NVR, XVR devices",
"versions": [
{
"status": "affected",
"version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019."
}
]
}
]
}
],
"published": "2021-09-15T22:15:10.687",
"references": [
{
"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "http://seclists.org/fulldisclosure/2021/Oct/13",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
"tags": [
"Vendor Advisory"
],
"source": "cybersecurity@dahuatech.com"
},
{
"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2021/Oct/13",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
},
{
"lang": "es",
"value": "Una vulnerabilidad de omisión de autenticación de identidad encontrada en algunos productos Dahua durante el proceso de inicio de sesión. Los atacantes pueden omitir la autenticación de identidad del dispositivo al construir paquetes de datos maliciosos"
}
],
"lastModified": "2026-06-17T03:54:04.020",
"cisaActionDue": "2024-09-11",
"cisaExploitAdd": "2024-08-21",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0356805-3ECF-4C6F-B2BF-95D507736C44",
"versionEndExcluding": "2.820.0000000.5.r.210705"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5AE9ACB0-4CB3-4CF5-A007-15EE977D782E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0D17050-41CA-4808-8ED3-F332FD00B551",
"versionEndExcluding": "2.800.0000000.29.r.210630"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8936A118-4AB5-4B09-A9FD-E624A68315BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F20DC69-B735-4547-826D-E4C42A39FE82",
"versionEndExcluding": "2.820.0000000.5.r.210705"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F2838BDA-97FF-498E-BC81-955D31B9227A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA1C3935-C83B-4A1A-BEEE-EF93F7722972",
"versionEndExcluding": "4.001.0000005.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-1xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7780D1BE-ABE0-4890-B493-36FA0A4B3266"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "795EF8B2-5E6D-46EB-9F66-85F2C71B2619",
"versionEndExcluding": "4.001.0000000.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-2xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "89E3F7B3-3C51-49C1-BAEC-DA4235D5A06D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1386662B-C3DE-467A-8F41-F18BDE7B9726",
"versionEndExcluding": "4.001.0000005.1.r.210713"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-4xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "58ECDC49-09D4-4E62-AC11-E3C52C656A9D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06A6B28A-2E0D-4E45-904A-66FEE5D85262",
"versionEndExcluding": "4.001.0000000.0.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-5xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DE621958-8AE2-44E0-9E41-94BC964CDF57"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90D5A1B3-88D5-4E5E-A88B-59409D41956C",
"versionEndExcluding": "4.001.0000001.1.r.210716"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:nvr-6xx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9EEAC798-870E-4DE6-B7DB-44FAF5360CE5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F1138DD-7149-4191-BF6B-5176B8EF3A07",
"versionEndExcluding": "4.500.0000002.0.r.210715"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "72039FDA-344D-4961-BB1B-E6F32EAFD7C2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AC98964-DBDE-438C-A0E7-BF11D1BBC4B0",
"versionEndExcluding": "4.300.0000004.0.r.210715"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9438ADC0-C8F4-48E1-A905-9914A3AE715E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3FFF94A-7F57-49D2-A6BA-5B58064C41C5",
"versionEndExcluding": "4.300.0000003.0.r.210714"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B205125D-5A33-49B0-A2BA-BD833D107924"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BFB4B89-FD66-4A9E-9163-8E27730012C8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97031A47-9275-45CD-AFBB-A906A3A37D71"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83753916-EBB9-4378-9448-79B33EA851C7",
"versionEndExcluding": "4.001.0000001.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x08:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D6962025-38D1-4B8E-9C51-2806599F8779"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3D44B80-93EF-41AD-9BFD-B363CC8356CF",
"versionEndExcluding": "4.001.0000001.1.r.210709"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97031A47-9275-45CD-AFBB-A906A3A37D71"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44FAD9FC-F99A-45DE-A8FA-031CD0F4680E",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x04:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F496B4C1-062B-4C6E-9F8C-C3B49D4D98EF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEAA6256-9F3D-43C7-858C-D07025EE5400",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x08:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AA245352-2E71-4401-AB16-1CA8D827D858"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C5D8D60-F5A5-42B2-830B-E4D89828988F",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-5x16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "60F64F53-4C08-48A1-A3EB-F3EB5A1C0631"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22635FB9-7898-457B-938B-9946CFC9EE73",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-7x16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "95CC3087-2310-4520-8B69-4F21F6F78197"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D80CC1B-87EC-44BF-A453-A57350A4C061",
"versionEndExcluding": "4.001.0000003.1.r.210710"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dahuasecurity:xvr-7x32:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "06268CD6-0DFD-4501-9D4E-AA25E14B215E"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@dahuatech.com",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Dahua IP Camera Authentication Bypass Vulnerability"
}