CVE-2021-33044
Dahua IP Camera Authentication Bypass Vulnerability
Description
CVE-2021-33044 is a critical authentication bypass vulnerability (CVSS 9.8) in Dahua surveillance product firmware, affecting the device login process across a broad range of IP cameras, thermal cameras, PTZ cameras, video intercoms, and door stations. Attackers can bypass identity authentication by constructing malicious data packets, gaining unauthorized access without valid credentials. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.27% (99.9th percentile), this vulnerability ranks among the most exploited CVEs globally, and public exploit code is readily available.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dahuasecurity | ipc-hum7xxx firmware | < 2.820.0000000.5.r.210705 |
| dahuasecurity | ipc-hx3xxx firmware | < 2.800.0000000.29.r.210630 |
| dahuasecurity | ipc-hx5xxx firmware | < 2.820.0000000.18.r.210705 |
| dahuasecurity | sd1a1 firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | sd22 firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | sd49 firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | sd50 firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | sd52c firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | sd6al firmware | < 2.812.0000007.0.r.210706 |
| dahuasecurity | tpc-bf1241 firmware | < 2.630.0000000.6.r.210707 |
| dahuasecurity | tpc-bf2221 firmware | < 2.630.0000000.10.r.210707 |
| dahuasecurity | tpc-bf5x01 firmware | < 2.630.0000000.12.r.210707 |
| dahuasecurity | tpc-pt8x21b firmware | < 2.630.0000000.10.r.210701 |
| dahuasecurity | tpc-sd2221 firmware | <= 2.630.0000000.7.r.210707 |
| dahuasecurity | tpc-sd8x21 firmware | < 2.630.0000000.9.r.210706 |
| dahuasecurity | vto-65xxx firmware | < 4.300.0000004.0.r.210715 |
| dahuasecurity | vto-75x95x firmware | < 4.300.0000003.0.r.210714 |
| dahuasecurity | vth-542xh firmware | < 4.500.0000002.0.r.210715 |
| dahuasecurity | tpc-bf5x21 firmware | < 2.630.0000000.8.r.210630 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2021/Oct/13(Exploit, Mailing List, Third Party Advisory)
- https://www.dahuasecurity.com/support/cybersecurity/details/957(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044(US Government Resource)
Weakness Type
Authentication Bypass
This vulnerability is an identity authentication bypass in the login process of Dahua surveillance products. The flaw allows attackers to circumvent the device's authentication mechanism entirely by sending specially crafted data packets during the login process. Authentication bypass in IoT surveillance devices is a particularly severe class of vulnerability because these devices control physical security infrastructure, are frequently deployed in sensitive environments, and often lack the monitoring and patching capabilities of traditional IT systems. Unlike related CVE-2021-33045 which affects a partially overlapping set of products, CVE-2021-33044 specifically impacts additional product families including thermal cameras (TPC series), SD PTZ cameras, and certain firmware variants, expanding the total attack surface across Dahua's product portfolio.
Impact Analysis
The CVSS score of 9.8 (Critical) indicates near-maximum severity with trivially exploitable conditions. Confidentiality impact is rated High, meaning an attacker gains full access to live and recorded video streams, thermal imaging data, audio feeds, and device configurations. For thermal camera deployments (TPC series), this includes access to temperature monitoring data that may be used in industrial processes or physical security screening. Integrity impact is also High, enabling attackers to manipulate camera configurations, disable recording, alter detection parameters, or use devices as network pivot points. Availability impact is High, allowing attackers to render surveillance systems non-functional.
The business consequences of this vulnerability are severe for organizations relying on Dahua surveillance equipment. Compromised thermal cameras in industrial settings could hide environmental hazards by masking temperature readings. Compromised PTZ cameras could be manipulated to create blind spots in security coverage. The EPSS score of 94.27% (99.9th percentile) means this vulnerability has one of the highest exploitation rates of any tracked CVE. Public exploits are available on Packet Storm Security and through the Full Disclosure mailing list, enabling mass automated exploitation. While the ransomware association is unknown, compromised surveillance devices are commonly recruited into botnets and used for persistent network access.
Exploit Maturity
CVE-2021-33044 is confirmed as actively exploited in the wild, as demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 11, 2024. The EPSS score of 94.27% (99.9th percentile) places it among the most heavily exploited vulnerabilities worldwide. Public exploit code is readily available through Packet Storm Security and the Full Disclosure mailing list, making exploitation accessible to any attacker regardless of skill level. Automated scanning tools continuously probe the internet for vulnerable Dahua devices, and the large installed base of these products ensures a substantial number of targets remain unpatched years after disclosure. The ransomware association is unknown, but the combination of trivial exploitation, mass deployment, and persistent internet exposure makes these devices prime targets for botnet operators and advanced threat actors seeking persistent network footholds.
Remediation
-
Update Dahua device firmware immediately — Consult the Dahua security advisory for patched firmware versions for each affected product line. Download firmware from Dahua's official support portal and apply updates through the device web interface or centralized management platform.
-
Network-isolate all surveillance devices — Place all Dahua cameras, NVRs, and related devices on a dedicated, segmented VLAN with strict ingress and egress firewall rules. Block all direct internet access from surveillance devices and use a VPN gateway for any required remote access.
-
Audit and secure all device credentials — Change all default and weak passwords across the entire Dahua device fleet. Implement unique, strong passwords for each device. Disable any unused accounts and enable account lockout where supported by the firmware version.
-
Scan for internet-exposed devices — Use external scanning services to identify any Dahua devices accessible from the public internet. Check for unintended port forwarding rules created by UPnP, DMZ configurations, or misconfigured firewalls. Close all unnecessary external access paths immediately.
-
Deploy IoT network monitoring — Implement network detection and response (NDR) solutions capable of monitoring traffic from IoT devices. Configure alerts for unexpected outbound connections, unusual authentication patterns, firmware modification attempts, and communication with known command-and-control infrastructure.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the most dangerous combination of exploitability factors. Attack Vector (Network) enables remote exploitation from anywhere on the network or internet. Attack Complexity (Low) requires no special preparation or conditions. Privileges Required (None) means no credentials are needed — the vulnerability explicitly bypasses the authentication requirement. User Interaction (None) allows fully automated, scalable attacks. Scope (Unchanged) limits the direct impact to the device itself, though compromised devices serve as attack platforms for lateral movement.
The technical mechanism is similar to the related CVE-2021-33045 but affects a distinct and broader set of Dahua product families. The vulnerability exists in the authentication protocol handling within the device's login process. During a normal login, the device receives authentication data and validates it against stored credentials. The flaw allows an attacker to construct specially crafted data packets that manipulate the authentication protocol in a way that causes the device to grant access without performing proper credential validation. The result is an authenticated session with full administrative privileges. This vulnerability affects the TPC (thermal camera) series including the BF1241, BF2221, BF5x01, and PT8x21B, the SD (speed dome) series including SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, as well as the VTH and VTO intercom and door station products. The diversity of affected product types means that a single exploit technique can compromise cameras, thermal sensors, PTZ systems, and access control devices across an entire Dahua deployment.
Frequently Asked Questions
What is CVE-2021-33044?
CVE-2021-33044 is a critical authentication bypass vulnerability in Dahua surveillance products that allows remote attackers to gain unauthorized access by constructing malicious login packets. It affects IP cameras, thermal cameras, PTZ cameras, video intercoms, and door stations, with a CVSS score of 9.8.
How does CVE-2021-33044 differ from CVE-2021-33045?
Both are authentication bypass vulnerabilities in Dahua products discovered at the same time, but they affect different (though partially overlapping) product families. CVE-2021-33044 specifically impacts thermal cameras (TPC series), speed dome cameras (SD series), and additional firmware variants not covered by CVE-2021-33045. Both should be patched simultaneously.
Are Dahua thermal cameras (TPC series) affected?
Yes, CVE-2021-33044 specifically affects several TPC thermal camera models including the TPC-BF1241, TPC-BF2221, TPC-BF5x01, TPC-BF5x21, TPC-PT8x21B, TPC-SD2221, and TPC-SD8x21. These devices should be updated to firmware released after July 2021 per Dahua's security advisory.
What is the most important immediate action?
The most critical step is to ensure that no affected Dahua devices are directly accessible from the internet. Network-isolate all surveillance devices immediately, then apply firmware updates from Dahua's security advisory. Even after patching, surveillance devices should remain on segmented networks with strict access controls.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.