CVE-2021-33045 : The identity authentication bypass vulnerability found in some Dahua products du

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Published 2021-09-15 22:15:11

Updated 2024-08-22 01:00:01

Source Dahua Technologies

View at NVD, CVE.org

Products affected by CVE-2021-33045

Dahuasecurity » Ipc-hum7xxx Firmware
Versions before (<) 2.820.0000000.5.r.210705
cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Ipc-hum7xxx » Version: N/A
Dahuasecurity » Ipc-hx3xxx Firmware
Versions before (<) 2.800.0000000.29.r.210630
cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Ipc-hx3xxx » Version: N/A
Dahuasecurity » Ipc-hx5xxx Firmware
Versions before (<) 2.820.0000000.5.r.210705
cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Ipc-hx5xxx » Version: N/A
Dahuasecurity » Nvr-1xxx Firmware
Versions before (<) 4.001.0000005.1.r.210709
cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Nvr-1xxx » Version: N/A
Dahuasecurity » Nvr-2xxx Firmware
Versions before (<) 4.001.0000000.1.r.210710
cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Nvr-2xxx » Version: N/A
Dahuasecurity » Nvr-4xxx Firmware
Versions before (<) 4.001.0000005.1.r.210713
cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Nvr-4xxx » Version: N/A
Dahuasecurity » Nvr-5xxx Firmware
Versions before (<) 4.001.0000000.0.r.210710
cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Nvr-5xxx » Version: N/A
Dahuasecurity » Nvr-6xx Firmware
Versions before (<) 4.001.0000001.1.r.210716
cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Nvr-6xx » Version: N/A
Dahuasecurity » Vth-542xh Firmware
Versions before (<) 4.500.0000002.0.r.210715
cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Vth-542xh » Version: N/A
Dahuasecurity » Vto-65xxx Firmware
Versions before (<) 4.300.0000004.0.r.210715
cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Vto-65xxx » Version: N/A
Dahuasecurity » Vto-75x95x Firmware
Versions before (<) 4.300.0000003.0.r.210714
cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Vto-75x95x » Version: N/A
Dahuasecurity » Xvr-4x04 Firmware
Versions before (<) 4.001.0000001.1.r.210709
cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-4x04 » Version: N/A
Dahuasecurity » Xvr-4x04 Firmware » Version: N/A
cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-4x04 » Version: N/A
Dahuasecurity » Xvr-4x08 Firmware
Versions before (<) 4.001.0000001.1.r.210709
cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-4x08 » Version: N/A
Dahuasecurity » Xvr-5x04 Firmware
Versions before (<) 4.001.0000003.1.r.210710
cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-5x04 » Version: N/A
Dahuasecurity » Xvr-5x08 Firmware
Versions before (<) 4.001.0000003.1.r.210710
cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-5x08 » Version: N/A
Dahuasecurity » Xvr-5x16 Firmware
Versions before (<) 4.001.0000003.1.r.210710
cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-5x16 » Version: N/A
Dahuasecurity » Xvr-7x16 Firmware
Versions before (<) 4.001.0000003.1.r.210710
cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-7x16 » Version: N/A
Dahuasecurity » Xvr-7x32 Firmware
Versions before (<) 4.001.0000003.1.r.210710
cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dahuasecurity » Xvr-7x32 » Version: N/A

CVE-2021-33045 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Dahua IP Camera Authentication Bypass Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

Notes:

https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33045

Added on 2024-08-21 Action due date 2024-09-11

Exploit prediction scoring system (EPSS) score for CVE-2021-33045

EPSS FAQ

83.84%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-33045

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-33045

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-33045

http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html

Dahua Authentication Bypass ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.dahuasecurity.com/support/cybersecurity/details/957

Security Advisory - Identity authentication bypass vulnerability found in some Dahua products
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2021/Oct/13

Full Disclosure: [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)
Exploit;Mailing List;Third Party Advisory

CVEs referencing this url