CVE-2021-33045

Some Dahua IP Camera, Video Intercom, NVR, XVR devices

Published 15 Sept 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 21 Aug 2024, with a remediation deadline of 11 Sept 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

References

packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html · Exploit, Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2021/Oct/13 · Exploit, Mailing List, Third Party Advisory
www.dahuasecurity.com/support/cybersecurity/details/957 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045 · US Government Resource