Evil-DB LogoEvil-DB
← All CVEs

CVE-2021-33045

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-08-21Remediation due 2024-09-11

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

9.8
CVSS
99.6%
EPSS (exploit prob.)
100th
EPSS percentile
2021-09-15
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

VendorProductAffected versions
dahuasecurityipc-hum7xxx_firmware< 2.820.0000000.5.r.210705
dahuasecurityipc-hum7xxxall versions
dahuasecurityipc-hx3xxx_firmware< 2.800.0000000.29.r.210630
dahuasecurityipc-hx3xxxall versions
dahuasecurityipc-hx5xxx_firmware< 2.820.0000000.5.r.210705
dahuasecurityipc-hx5xxxall versions
dahuasecuritynvr-1xxx_firmware< 4.001.0000005.1.r.210709
dahuasecuritynvr-1xxxall versions
dahuasecuritynvr-2xxx_firmware< 4.001.0000000.1.r.210710
dahuasecuritynvr-2xxxall versions
dahuasecuritynvr-4xxx_firmware< 4.001.0000005.1.r.210713
dahuasecuritynvr-4xxxall versions
dahuasecuritynvr-5xxx_firmware< 4.001.0000000.0.r.210710
dahuasecuritynvr-5xxxall versions
dahuasecuritynvr-6xx_firmware< 4.001.0000001.1.r.210716
dahuasecuritynvr-6xxall versions
dahuasecurityvth-542xh_firmware< 4.500.0000002.0.r.210715
dahuasecurityvth-542xhall versions
dahuasecurityvto-65xxx_firmware< 4.300.0000004.0.r.210715
dahuasecurityvto-65xxxall versions
dahuasecurityvto-75x95x_firmware< 4.300.0000003.0.r.210714
dahuasecurityvto-75x95xall versions
dahuasecurityxvr-4x04_firmwareall versions
dahuasecurityxvr-4x04all versions
dahuasecurityxvr-4x08_firmware< 4.001.0000001.1.r.210709
dahuasecurityxvr-4x08all versions
dahuasecurityxvr-4x04_firmware< 4.001.0000001.1.r.210709
dahuasecurityxvr-4x04all versions
dahuasecurityxvr-5x04_firmware< 4.001.0000003.1.r.210710
dahuasecurityxvr-5x04all versions
dahuasecurityxvr-5x08_firmware< 4.001.0000003.1.r.210710
dahuasecurityxvr-5x08all versions
dahuasecurityxvr-5x16_firmware< 4.001.0000003.1.r.210710
dahuasecurityxvr-5x16all versions
dahuasecurityxvr-7x16_firmware< 4.001.0000003.1.r.210710
dahuasecurityxvr-7x16all versions
dahuasecurityxvr-7x32_firmware< 4.001.0000003.1.r.210710
dahuasecurityxvr-7x32all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-33045