Live › vulnerability › CVE-2021-33045
Go to dashboardDahua IP camera firmware accepts a loopback device specified by the client during authentication, which skips the login check. An attacker who can reach the camera can log in without valid credentials and act as an authenticated user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Dahua IP Camera Firmware | vendor | – | – |
| dahuasecurity ipc-hum7xxx firmware | vendor | < 2.820.0000000.5.r.210705 | 2.820.0000000.5.r.210705 |
| dahuasecurity ipc-hx3xxx firmware | vendor | < 2.800.0000000.29.r.210630 | 2.800.0000000.29.r.210630 |
| dahuasecurity ipc-hx5xxx firmware | vendor | < 2.820.0000000.5.r.210705 | 2.820.0000000.5.r.210705 |
| dahuasecurity nvr-1xxx firmware | vendor | < 4.001.0000005.1.r.210709 | 4.001.0000005.1.r.210709 |
| dahuasecurity nvr-2xxx firmware | vendor | < 4.001.0000000.1.r.210710 | 4.001.0000000.1.r.210710 |
| dahuasecurity nvr-4xxx firmware | vendor | < 4.001.0000005.1.r.210713 | 4.001.0000005.1.r.210713 |
| dahuasecurity nvr-5xxx firmware | vendor | < 4.001.0000000.0.r.210710 | 4.001.0000000.0.r.210710 |
| dahuasecurity nvr-6xx firmware | vendor | < 4.001.0000001.1.r.210716 | 4.001.0000001.1.r.210716 |
| dahuasecurity vth-542xh firmware | vendor | < 4.500.0000002.0.r.210715 | 4.500.0000002.0.r.210715 |
| dahuasecurity vto-65xxx firmware | vendor | < 4.300.0000004.0.r.210715 | 4.300.0000004.0.r.210715 |
| dahuasecurity vto-75x95x firmware | vendor | < 4.300.0000003.0.r.210714 | 4.300.0000003.0.r.210714 |
| dahuasecurity xvr-4x04 firmware | vendor | – | – |
| dahuasecurity xvr-4x08 firmware | vendor | < 4.001.0000001.1.r.210709 | 4.001.0000001.1.r.210709 |
| dahuasecurity xvr-4x04 firmware | vendor | < 4.001.0000001.1.r.210709 | 4.001.0000001.1.r.210709 |
| dahuasecurity xvr-5x04 firmware | vendor | < 4.001.0000003.1.r.210710 | 4.001.0000003.1.r.210710 |
| dahuasecurity xvr-5x08 firmware | vendor | < 4.001.0000003.1.r.210710 | 4.001.0000003.1.r.210710 |
| dahuasecurity xvr-5x16 firmware | vendor | < 4.001.0000003.1.r.210710 | 4.001.0000003.1.r.210710 |
| dahuasecurity xvr-7x16 firmware | vendor | < 4.001.0000003.1.r.210710 | 4.001.0000003.1.r.210710 |
| dahuasecurity xvr-7x32 firmware | vendor | < 4.001.0000003.1.r.210710 | 4.001.0000003.1.r.210710 |
Identify Dahua IP cameras and related devices on your network and compare their firmware against the vendor advisory; the sources do not give a version or command.
Apply the vendor mitigation or firmware update for Dahua; if no mitigation is available, stop using the affected product (per CISA).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2021-33045")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.