Evil-DB LogoEvil-DB
← All CVEs

CVE-2021-33044

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-08-21Remediation due 2024-09-11

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

9.8
CVSS
99.9%
EPSS (exploit prob.)
100th
EPSS percentile
2021-09-15
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

VendorProductAffected versions
dahuasecurityipc-hum7xxx_firmware< 2.820.0000000.5.r.210705
dahuasecurityipc-hum7xxxall versions
dahuasecurityipc-hx3xxx_firmware< 2.800.0000000.29.r.210630
dahuasecurityipc-hx3xxxall versions
dahuasecurityipc-hx5xxx_firmware< 2.820.0000000.18.r.210705
dahuasecurityipc-hx5xxxall versions
dahuasecuritysd1a1_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd1a1all versions
dahuasecuritysd22_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd22all versions
dahuasecuritysd49_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd49all versions
dahuasecuritysd50_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd50all versions
dahuasecuritysd52c_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd52call versions
dahuasecuritysd6al_firmware< 2.812.0000007.0.r.210706
dahuasecuritysd6alall versions
dahuasecuritytpc-bf1241_firmware< 2.630.0000000.6.r.210707
dahuasecuritytpc-bf1241all versions
dahuasecuritytpc-bf2221_firmware< 2.630.0000000.10.r.210707
dahuasecuritytpc-bf2221all versions
dahuasecuritytpc-bf5x01_firmware< 2.630.0000000.12.r.210707
dahuasecuritytpc-bf5x01all versions
dahuasecuritytpc-pt8x21b_firmware< 2.630.0000000.10.r.210701
dahuasecuritytpc-pt8x21ball versions
dahuasecuritytpc-sd2221_firmware<= 2.630.0000000.7.r.210707
dahuasecuritytpc-sd2221all versions
dahuasecuritytpc-sd8x21_firmware< 2.630.0000000.9.r.210706
dahuasecuritytpc-sd8x21all versions
dahuasecurityvto-65xxx_firmware< 4.300.0000004.0.r.210715
dahuasecurityvto-65xxxall versions
dahuasecurityvto-75x95x_firmware< 4.300.0000003.0.r.210714
dahuasecurityvto-75x95xall versions
dahuasecurityvth-542xh_firmware< 4.500.0000002.0.r.210715
dahuasecurityvth-542xhall versions
dahuasecuritytpc-bf5x21_firmware< 2.630.0000000.8.r.210630
dahuasecuritytpc-bf5x21all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-33044