Read the docs
TI-2021-12646 Aliases CVE-2021-33045GHSA-9vwj-hj2h-whjq

Improper authentication in Some Dahua IP Camera, Video Intercom, NVR, XVR devices

Priority CRITICAL 100Exploited in the wildCWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Why it matters now

Exploitation Active In CISA KEV since 2024-08-21CISA due date 2024-09-11
EPSS 0.99593 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Some Dahua IP Camera, Video Intercom, NVR, XVR devicesDahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019.—No fix listedCNA
  • Some Dahua IP Camera, Video Intercom, NVR, XVR devices Vendor— Affected Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019. Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*before 2.820.0000000.5.r.210705VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*before 2.800.0000000.29.r.210630VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*before 2.820.0000000.5.r.210705VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*before 4.001.0000005.1.r.210709VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:nvr-1xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*before 4.001.0000000.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:nvr-2xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:* Versions before 2.820.0000000.5.r.210705 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:* Versions before 2.800.0000000.29.r.210630 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:* Versions before 2.820.0000000.5.r.210705 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000005.1.r.210709 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:nvr-1xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000000.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:nvr-2xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*before 4.001.0000005.1.r.210713VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:nvr-4xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*before 4.001.0000000.0.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:nvr-5xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*before 4.001.0000001.1.r.210716VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:nvr-6xx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*before 4.500.0000002.0.r.210715VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*before 4.300.0000004.0.r.210715VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*before 4.300.0000003.0.r.210714VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*before 4.001.0000001.1.r.210709VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-4x08:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*before 4.001.0000001.1.r.210709VulnerableDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*before 4.001.0000003.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-5x04:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*before 4.001.0000003.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-5x08:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*before 4.001.0000003.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-5x16:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*before 4.001.0000003.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-7x16:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*before 4.001.0000003.1.r.210710VulnerableDahua Technologies
cpe:2.3:h:dahuasecurity:xvr-7x32:-:*:*:*:*:*:*:*not specified by NVDRunning onDahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000005.1.r.210713 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:nvr-4xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000000.0.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:nvr-5xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000001.1.r.210716 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:nvr-6xx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:* Versions before 4.500.0000002.0.r.210715 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:* Versions before 4.300.0000004.0.r.210715 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:* Versions before 4.300.0000003.0.r.210714 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000001.1.r.210709 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-4x08:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000001.1.r.210709 Vulnerable ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000003.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-5x04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000003.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-5x08:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000003.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-5x16:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000003.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-7x16:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies
  • cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:* Versions before 4.001.0000003.1.r.210710 Vulnerable ·Dahua Technologies
  • cpe:2.3:h:dahuasecurity:xvr-7x32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dahua Technologies

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-08-21 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-33045
  3. 2026-10-03 Alias added: GHSA-9vwj-hj2h-whjq

References

Exploit 2

Advisory 1

  • TI-2021-12645 Improper authentication in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-03585 Dahua Smart Park Management unrestricted upload CVSS 3.1CRITICAL 9.8
  • TI-2024-12178 Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal CVSS 4.0MEDIUM 5.3
  • TI-2019-02954 Missing authentication in Dahua IPC-XXBXX CVSS 3.0HIGH 7.5
  • TI-2025-43987 Command injection in Dahua Intelligent Connection Center CVSS 3.1CRITICAL 9.8
  • TI-2017-02426 Stack-based buffer overflow in Dahua IP Camera CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences