{"id":"CVE-2021-33045","kind":"vulnerability","aliases":["CVE-2021-33045"],"related":[],"title":"The identity authentication bypass vulnerability found in some Dahua products during the login process","description":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Dahua IP camera firmware accepts a loopback device specified by the client during authentication, which skips the login check. An attacker who can reach the camera can log in without valid credentials and act as an authenticated user.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-08-21T00:00:00+00:00","products":[{"name":"Dahua IP Camera Firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dahuasecurity ipc-hum7xxx firmware","fixed":["2.820.0000000.5.r.210705"],"affected":"< 2.820.0000000.5.r.210705","ecosystem":"vendor"},{"name":"dahuasecurity ipc-hx3xxx firmware","fixed":["2.800.0000000.29.r.210630"],"affected":"< 2.800.0000000.29.r.210630","ecosystem":"vendor"},{"name":"dahuasecurity ipc-hx5xxx firmware","fixed":["2.820.0000000.5.r.210705"],"affected":"< 2.820.0000000.5.r.210705","ecosystem":"vendor"},{"name":"dahuasecurity nvr-1xxx firmware","fixed":["4.001.0000005.1.r.210709"],"affected":"< 4.001.0000005.1.r.210709","ecosystem":"vendor"},{"name":"dahuasecurity nvr-2xxx firmware","fixed":["4.001.0000000.1.r.210710"],"affected":"< 4.001.0000000.1.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity nvr-4xxx firmware","fixed":["4.001.0000005.1.r.210713"],"affected":"< 4.001.0000005.1.r.210713","ecosystem":"vendor"},{"name":"dahuasecurity nvr-5xxx firmware","fixed":["4.001.0000000.0.r.210710"],"affected":"< 4.001.0000000.0.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity nvr-6xx firmware","fixed":["4.001.0000001.1.r.210716"],"affected":"< 4.001.0000001.1.r.210716","ecosystem":"vendor"},{"name":"dahuasecurity vth-542xh firmware","fixed":["4.500.0000002.0.r.210715"],"affected":"< 4.500.0000002.0.r.210715","ecosystem":"vendor"},{"name":"dahuasecurity vto-65xxx firmware","fixed":["4.300.0000004.0.r.210715"],"affected":"< 4.300.0000004.0.r.210715","ecosystem":"vendor"},{"name":"dahuasecurity vto-75x95x firmware","fixed":["4.300.0000003.0.r.210714"],"affected":"< 4.300.0000003.0.r.210714","ecosystem":"vendor"},{"name":"dahuasecurity xvr-4x04 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dahuasecurity xvr-4x08 firmware","fixed":["4.001.0000001.1.r.210709"],"affected":"< 4.001.0000001.1.r.210709","ecosystem":"vendor"},{"name":"dahuasecurity xvr-4x04 firmware","fixed":["4.001.0000001.1.r.210709"],"affected":"< 4.001.0000001.1.r.210709","ecosystem":"vendor"},{"name":"dahuasecurity xvr-5x04 firmware","fixed":["4.001.0000003.1.r.210710"],"affected":"< 4.001.0000003.1.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity xvr-5x08 firmware","fixed":["4.001.0000003.1.r.210710"],"affected":"< 4.001.0000003.1.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity xvr-5x16 firmware","fixed":["4.001.0000003.1.r.210710"],"affected":"< 4.001.0000003.1.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity xvr-7x16 firmware","fixed":["4.001.0000003.1.r.210710"],"affected":"< 4.001.0000003.1.r.210710","ecosystem":"vendor"},{"name":"dahuasecurity xvr-7x32 firmware","fixed":["4.001.0000003.1.r.210710"],"affected":"< 4.001.0000003.1.r.210710","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dahua","exploited","firmware","infrastructure","ip-camera"],"not_affected_if":["no-dahua-devices"],"how_to_check":"Identify Dahua IP cameras and related devices on your network and compare their firmware against the vendor advisory; the sources do not give a version or command.","fix":"Apply the vendor mitigation or firmware update for Dahua; if no mitigation is available, stop using the affected product (per CISA).","status":"open","published_at":"2021-09-15T22:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:22+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or firmware update for Dahua; if no mitigation is available, stop using the affected product (per CISA).\nunknown","reach":"network","impact":"high","summary":"Dahua IP camera firmware accepts a loopback device specified by the client during authentication, which skips the login check. An attacker who can reach the camera can log in without valid credentials and act as an authenticated user.","category":"infrastructure","who_cares":["dahua","ip-camera","firmware"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker bypasses login and gets administrative control of the camera.","analyst_note":"Find the Dahua advisory and affected/fixed firmware versions and the exact check for the loopback auth bypass; sources give none.","how_to_check":"Identify Dahua IP cameras and related devices on your network and compare their firmware against the vendor advisory; the sources do not give a version or command.\nunknown","needs_analyst":true,"not_affected_if":["no-dahua-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000478,"input_tokens":2813,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,19A '-33045':17A,20A '1xxx':43A '2xxx':48A '4x04':83A,93A '4x08':88A '4xxx':53A '542xh':68A '5x04':98A '5x08':103A '5x16':108A '5xxx':58A '65xxx':73A '6xx':63A '75x95x':78A '7x16':113A '7x32':118A 'accept':131B 'act':160B 'action':189C 'appli':190C 'attack':147B 'authent':3A,140B,163B,173C,186C 'bypass':4A,174C 'camera':23A,126B,129B,152B,167C 'check':145B 'cisa':187C 'client':138B,184C 'contain':171C 'credenti':158B 'cve':15A,18A 'dahua':9A,21A,120B,127B,165C 'dahuasecurity':25A,30A,35A,40A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A,115A 'devic':134B,179C 'discontinu':196C 'exploit':121B 'firmwar':122B,130B 'firmware':24A,29A,34A,39A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,119A 'found':6A 'hum7xxx':28A 'hx3xxx':33A 'hx5xxx':38A 'ident':2A 'infrastructur':123B 'instruct':194C 'ip':22A,125B,128B,166C 'ip-camera':124B 'ipc':27A,32A,37A 'ipc-hum7xxx':26A 'ipc-hx3xxx':31A 'ipc-hx5xxx':36A 'log':154B 'login':13A,144B 'loopback':133B,178C 'mitig':191C,202C 'nvr':42A,47A,52A,57A,62A 'nvr-1xxx':41A 'nvr-2xxx':46A 'nvr-4xxx':51A 'nvr-5xxx':56A 'nvr-6xx':61A 'per':192C 'process':14A 'product':10A,170C,200C 'reach':150B 'relat':169C 'requir':188C 'skip':142B 'specifi':135B,181C 'unavail':204C 'use':197C 'user':164B 'valid':157B 'vendor':193C 'vth':67A 'vth-542xh':66A 'vto':72A,77A 'vto-65xxx':71A 'vto-75x95x':76A 'vulner':5A,175C 'without':156B 'xvr':82A,87A,92A,97A,102A,107A,112A,117A 'xvr-4x04':81A,91A 'xvr-4x08':86A 'xvr-5x04':96A 'xvr-5x08':101A 'xvr-5x16':106A 'xvr-7x16':111A 'xvr-7x32':116A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-15T22:15:10+00:00","kev":{"dateAdded":"2024-08-21","dueDate":"2024-09-11","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-33045","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33045","severity":null,"published_at":"2024-08-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-33045","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33045","severity":null,"published_at":"2021-09-15T22:15:10+00:00","modified_at":"2026-06-17T03:54:04+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}