--- id: "CVE-2021-33045" kind: "vulnerability" aliases: ["CVE-2021-33045"] title: "The identity authentication bypass vulnerability found in some Dahua products during the login process" severity: "critical" cvss: 10.0 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Dahua IP Camera Firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dahuasecurity ipc-hum7xxx firmware", "fixed": ["2.820.0000000.5.r.210705"], "affected": "< 2.820.0000000.5.r.210705", "ecosystem": "vendor"}, {"name": "dahuasecurity ipc-hx3xxx firmware", "fixed": ["2.800.0000000.29.r.210630"], "affected": "< 2.800.0000000.29.r.210630", "ecosystem": "vendor"}, {"name": "dahuasecurity ipc-hx5xxx firmware", "fixed": ["2.820.0000000.5.r.210705"], "affected": "< 2.820.0000000.5.r.210705", "ecosystem": "vendor"}, {"name": "dahuasecurity nvr-1xxx firmware", "fixed": ["4.001.0000005.1.r.210709"], "affected": "< 4.001.0000005.1.r.210709", "ecosystem": "vendor"}, {"name": "dahuasecurity nvr-2xxx firmware", "fixed": ["4.001.0000000.1.r.210710"], "affected": "< 4.001.0000000.1.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity nvr-4xxx firmware", "fixed": ["4.001.0000005.1.r.210713"], "affected": "< 4.001.0000005.1.r.210713", "ecosystem": "vendor"}, {"name": "dahuasecurity nvr-5xxx firmware", "fixed": ["4.001.0000000.0.r.210710"], "affected": "< 4.001.0000000.0.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity nvr-6xx firmware", "fixed": ["4.001.0000001.1.r.210716"], "affected": "< 4.001.0000001.1.r.210716", "ecosystem": "vendor"}, {"name": "dahuasecurity vth-542xh firmware", "fixed": ["4.500.0000002.0.r.210715"], "affected": "< 4.500.0000002.0.r.210715", "ecosystem": "vendor"}, {"name": "dahuasecurity vto-65xxx firmware", "fixed": ["4.300.0000004.0.r.210715"], "affected": "< 4.300.0000004.0.r.210715", "ecosystem": "vendor"}, {"name": "dahuasecurity vto-75x95x firmware", "fixed": ["4.300.0000003.0.r.210714"], "affected": "< 4.300.0000003.0.r.210714", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-4x04 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-4x08 firmware", "fixed": ["4.001.0000001.1.r.210709"], "affected": "< 4.001.0000001.1.r.210709", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-4x04 firmware", "fixed": ["4.001.0000001.1.r.210709"], "affected": "< 4.001.0000001.1.r.210709", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-5x04 firmware", "fixed": ["4.001.0000003.1.r.210710"], "affected": "< 4.001.0000003.1.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-5x08 firmware", "fixed": ["4.001.0000003.1.r.210710"], "affected": "< 4.001.0000003.1.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-5x16 firmware", "fixed": ["4.001.0000003.1.r.210710"], "affected": "< 4.001.0000003.1.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-7x16 firmware", "fixed": ["4.001.0000003.1.r.210710"], "affected": "< 4.001.0000003.1.r.210710", "ecosystem": "vendor"}, {"name": "dahuasecurity xvr-7x32 firmware", "fixed": ["4.001.0000003.1.r.210710"], "affected": "< 4.001.0000003.1.r.210710", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["dahua", "exploited", "firmware", "infrastructure", "ip-camera"] not_affected_if: ["no-dahua-devices"] published_at: "2021-09-15T22:15:10+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:05+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33045", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33045", "first_seen_at": "2026-10-23T22:29:05+00:00"}] --- # The identity authentication bypass vulnerability found in some Dahua products during the login process Dahua IP camera firmware accepts a loopback device specified by the client during authentication, which skips the login check. An attacker who can reach the camera can log in without valid credentials and act as an authenticated user. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Dahua IP Camera Firmware affected ? fixed ? - vendor:dahuasecurity ipc-hum7xxx firmware affected < 2.820.0000000.5.r.210705 fixed 2.820.0000000.5.r.210705 - vendor:dahuasecurity ipc-hx3xxx firmware affected < 2.800.0000000.29.r.210630 fixed 2.800.0000000.29.r.210630 - vendor:dahuasecurity ipc-hx5xxx firmware affected < 2.820.0000000.5.r.210705 fixed 2.820.0000000.5.r.210705 - vendor:dahuasecurity nvr-1xxx firmware affected < 4.001.0000005.1.r.210709 fixed 4.001.0000005.1.r.210709 - vendor:dahuasecurity nvr-2xxx firmware affected < 4.001.0000000.1.r.210710 fixed 4.001.0000000.1.r.210710 - vendor:dahuasecurity nvr-4xxx firmware affected < 4.001.0000005.1.r.210713 fixed 4.001.0000005.1.r.210713 - vendor:dahuasecurity nvr-5xxx firmware affected < 4.001.0000000.0.r.210710 fixed 4.001.0000000.0.r.210710 - vendor:dahuasecurity nvr-6xx firmware affected < 4.001.0000001.1.r.210716 fixed 4.001.0000001.1.r.210716 - vendor:dahuasecurity vth-542xh firmware affected < 4.500.0000002.0.r.210715 fixed 4.500.0000002.0.r.210715 - vendor:dahuasecurity vto-65xxx firmware affected < 4.300.0000004.0.r.210715 fixed 4.300.0000004.0.r.210715 - vendor:dahuasecurity vto-75x95x firmware affected < 4.300.0000003.0.r.210714 fixed 4.300.0000003.0.r.210714 - vendor:dahuasecurity xvr-4x04 firmware affected ? fixed ? - vendor:dahuasecurity xvr-4x08 firmware affected < 4.001.0000001.1.r.210709 fixed 4.001.0000001.1.r.210709 - vendor:dahuasecurity xvr-4x04 firmware affected < 4.001.0000001.1.r.210709 fixed 4.001.0000001.1.r.210709 - vendor:dahuasecurity xvr-5x04 firmware affected < 4.001.0000003.1.r.210710 fixed 4.001.0000003.1.r.210710 - vendor:dahuasecurity xvr-5x08 firmware affected < 4.001.0000003.1.r.210710 fixed 4.001.0000003.1.r.210710 - vendor:dahuasecurity xvr-5x16 firmware affected < 4.001.0000003.1.r.210710 fixed 4.001.0000003.1.r.210710 - vendor:dahuasecurity xvr-7x16 firmware affected < 4.001.0000003.1.r.210710 fixed 4.001.0000003.1.r.210710 - vendor:dahuasecurity xvr-7x32 firmware affected < 4.001.0000003.1.r.210710 fixed 4.001.0000003.1.r.210710 ## How to check Identify Dahua IP cameras and related devices on your network and compare their firmware against the vendor advisory; the sources do not give a version or command. ## Fix Apply the vendor mitigation or firmware update for Dahua; if no mitigation is available, stop using the affected product (per CISA). ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33045 - 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-33045 ## From the sources Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_