What’s Vulnerable › Vulnerabilities
CVE-2021-33044: Dahua IP Camera Authentication Bypass Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2024-08-21
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-09-15 · updated 2026-06-17
- Weakness: CWE-287
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Affected products
- Dahuasecurity Ipc-Hum7Xxx Firmware: before 2.820.0000000.5.r.210705 — fixed in 2.820.0000000.5.r.210705
- Dahuasecurity Ipc-Hx3Xxx Firmware: before 2.800.0000000.29.r.210630 — fixed in 2.800.0000000.29.r.210630
- Dahuasecurity Ipc-Hx5Xxx Firmware: before 2.820.0000000.18.r.210705 — fixed in 2.820.0000000.18.r.210705
- Dahuasecurity Sd1A1 Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Sd22 Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Sd49 Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Sd50 Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Sd52C Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Sd6Al Firmware: before 2.812.0000007.0.r.210706 — fixed in 2.812.0000007.0.r.210706
- Dahuasecurity Tpc-Bf1241 Firmware: before 2.630.0000000.6.r.210707 — fixed in 2.630.0000000.6.r.210707
- Dahuasecurity Tpc-Bf2221 Firmware: before 2.630.0000000.10.r.210707 — fixed in 2.630.0000000.10.r.210707
- Dahuasecurity Tpc-Bf5X01 Firmware: before 2.630.0000000.12.r.210707 — fixed in 2.630.0000000.12.r.210707
- Dahuasecurity Tpc-Bf5X21 Firmware: before 2.630.0000000.8.r.210630 — fixed in 2.630.0000000.8.r.210630
- Dahuasecurity Tpc-Pt8X21B Firmware: before 2.630.0000000.10.r.210701 — fixed in 2.630.0000000.10.r.210701
- Dahuasecurity Tpc-Sd2221 Firmware: through 2.630.0000000.7.r.210707
- Dahuasecurity Tpc-Sd8X21 Firmware: before 2.630.0000000.9.r.210706 — fixed in 2.630.0000000.9.r.210706
- Dahuasecurity Vth-542Xh Firmware: before 4.500.0000002.0.r.210715 — fixed in 4.500.0000002.0.r.210715
- Dahuasecurity Vto-65Xxx Firmware: before 4.300.0000004.0.r.210715 — fixed in 4.300.0000004.0.r.210715
- Dahuasecurity Vto-75X95X Firmware: before 4.300.0000003.0.r.210714 — fixed in 4.300.0000003.0.r.210714
How to fix
Upgrade to a fixed version: Dahuasecurity Ipc-Hum7Xxx Firmware 2.820.0000000.5.r.210705; Dahuasecurity Ipc-Hx3Xxx Firmware 2.800.0000000.29.r.210630; Dahuasecurity Ipc-Hx5Xxx Firmware 2.820.0000000.18.r.210705; Dahuasecurity Sd1A1 Firmware 2.812.0000007.0.r.210706; Dahuasecurity Sd22 Firmware 2.812.0000007.0.r.210706; Dahuasecurity Sd49 Firmware 2.812.0000007.0.r.210706; Dahuasecurity Sd50 Firmware 2.812.0000007.0.r.210706; Dahuasecurity Sd52C Firmware 2.812.0000007.0.r.210706; Dahuasecurity Sd6Al Firmware 2.812.0000007.0.r.210706; Dahuasecurity Tpc-Bf1241 Firmware 2.630.0000000.6.r.210707; Dahuasecurity Tpc-Bf2221 Firmware 2.630.0000000.10.r.210707; Dahuasecurity Tpc-Bf5X01 Firmware 2.630.0000000.12.r.210707. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2021/Oct/13
- https://www.dahuasecurity.com/support/cybersecurity/details/957
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044
Get alerted when CVE-2021-33044 or the next vulnerability affects your stack