{"id":"CVE-2021-33044","published":"2021-09-15T22:15:10Z","modified":"2026-06-17T03:54:03Z","title":"Dahua IP Camera Authentication Bypass Vulnerability","vendor":"Dahua","product":"IP Camera Firmware","tier":"core","eol":null,"description":{"text":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an identity authentication bypass in the login process of certain Dahua IP camera firmware, where the device's identity verification can be circumvented. An attacker can exploit it remotely over the network by sending specially constructed malicious data packets, requiring no credentials and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99989,"percentile":0.99984,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-08-21","dueDate":"2024-09-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33044","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-12-05","exploitedFirstSeen":"2023-12-05","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2021-33044","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-18&host_type=src&vulnerability=cve-2021-33044","date":"2023-12-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-24&host_type=src&vulnerability=cve-2021-33044","date":"2023-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-28&host_type=src&vulnerability=cve-2021-33044","date":"2023-12-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-02&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2021-33044","date":"2024-01-30"}],"evidenceTotal":618,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/13","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/957","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/13","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/957","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","report-attack-id"],"basisDetail":"claude-haiku-5-5: network-facing packet crafting bypasses authentication; ATT&CK ID T1190 introduces a list containing CVE-2021-33044","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"bypass device identity authentication by constructing malicious data packets","start":118,"end":194},{"reportId":"SRC-cb049733b1fc717427aa","quote":"Line Argument Parsing)\r\n CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)\r\n CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw)\r\nAnalysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as\r\ndetailed throughout this advisory:\r\n CVE-2021-33044 (Dahua","start":9888,"end":10191}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: authentication bypass grants access as legitimate identity","mappingType":"primary_impact","evidence":[{"from":"description","quote":"identity authentication bypass vulnerability found in some Dahua products","start":4,"end":77}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":"Line Argument Parsing)\r\n CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)\r\n CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw)\r\nAnalysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as\r\ndetailed throughout this advisory:\r\n CVE-2021-33044 (Dahua","start":9888,"end":10191},{"quote":"In one instance, Unit 29155 cyber actors exploited CVE-2021-33044 and CVE-2021-","start":11511,"end":11590},{"quote":"CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-","start":25317,"end":25378},{"quote":" NIST NVD: CVE-2021-33044","start":36991,"end":37017}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-19759","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-19759","exploited":true,"exploitedSince":"2024-08-21","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2021-10-11","earliestUrl":"https://github.com/bp2008/DahuaLoginBypass","repos":[{"name":"bp2008/DahuaLoginBypass","url":"https://github.com/bp2008/DahuaLoginBypass","stars":204,"created":"2021-10-11"},{"name":"umair-aziz025/dahua-cve-research","url":"https://github.com/umair-aziz025/dahua-cve-research","stars":32,"created":"2026-03-03"},{"name":"Spy0x7/CVE-2021-33044","url":"https://github.com/Spy0x7/CVE-2021-33044","stars":5,"created":"2021-10-18"},{"name":"haingn/LoHongCam-CVE-2021-33044","url":"https://github.com/haingn/LoHongCam-CVE-2021-33044","stars":4,"created":"2023-10-22"},{"name":"Baza-NATO/CVE-2021-33044","url":"https://github.com/Baza-NATO/CVE-2021-33044","stars":1,"created":"2026-01-25"}]},"nuclei":[{"id":"CVE-2021-33044","name":"Dahua IPC/VTH/VTO - Authentication Bypass","severity":"critical","path":"http/cves/2021/CVE-2021-33044.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33044.yaml"}],"first":{"date":"2021-10-11","source":"PoC-in-GitHub","url":"https://github.com/bp2008/DahuaLoginBypass"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html","http://seclists.org/fulldisclosure/2021/Oct/13"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2021-09-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33044","provenance":"source"},{"date":"2021-10-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/bp2008/DahuaLoginBypass","provenance":"source"},{"date":"2023-12-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2021-33044","provenance":"source"},{"date":"2024-08-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-08-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-19759","provenance":"source"}],"speed":{"daysToPublicExploit":26,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1071},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1061 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}