CVE-2021-33044
En bref Sévérité CRITICAL 9.8 Exploitation Exploitation connue (CISA KEV) · ajoutée le 2024-08-21 Exploitée selon l'ENISA depuis le 2024-08-21 EPSS EPSS 99.99 % · centile 100 (2026-10-27) État PUBLISHED Publiée 2021-09-15 Mise à jour 2026-01-12 Attribuée par dahua Statut NVD Analyzed Description The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 HIGH 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:* < 2.820.0000000.5.r.210705cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:* < 2.800.0000000.29.r.210630cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:* < 2.820.0000000.18.r.210705cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd49_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:* < 2.812.0000007.0.r.210706cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.6.r.210707cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.10.r.210707cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.12.r.210707cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.10.r.210701cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:* ≤ 2.630.0000000.7.r.210707cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.9.r.210706cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:* < 4.300.0000004.0.r.210715cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:* < 4.300.0000003.0.r.210714cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:* < 4.500.0000002.0.r.210715cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:* < 2.630.0000000.8.r.210630Produits affectés Produit Versions Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices affected Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.
Références
Sources
