CVE-2021-33044
At a glance Severity CRITICAL 9.8 Exploitation Known exploited (CISA KEV) · added 2024-08-21 Exploited per ENISA since 2024-08-21 EPSS EPSS 99.99 % · percentile 100 (2026-10-27) State PUBLISHED Published 2021-09-15 Updated 2026-01-12 Assigner dahua NVD status Analyzed Description The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 HIGH 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:* < 2.820.0000000.5.r.210705cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:* < 2.800.0000000.29.r.210630cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:* < 2.820.0000000.18.r.210705cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd49_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.6.r.210707cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.10.r.210707cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.12.r.210707cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.10.r.210701cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:* ≤ 2.630.0000000.7.r.210707cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.9.r.210706cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:* < 4.300.0000004.0.r.210715cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:* < 4.300.0000003.0.r.210714cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:* < 4.500.0000002.0.r.210715cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.8.r.210630Affected products Product Versions Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices affected Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.
References
Sources
