Dahua · IP Camera Firmware
The flaw is an identity authentication bypass in the login process of certain Dahua IP camera firmware, where the device's identity verification can be circumvented. An attacker can exploit it remotely over the network by sending specially constructed malicious data packets, requiring no credentials and no user interaction.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
First seen exploited 2 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 26 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
authentication bypass grants access as legitimate identity
identity authentication bypass vulnerability found in some Dahua products
network-facing packet crafting bypasses authentication; ATT&CK ID T1190 introduces a list containing CVE-2021-33044
bypass device identity authentication by constructing malicious data packets
Line Argument Parsing) CVE-2021-4034 (Red Hat: Polkit Privilege Escalation) CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory: CVE-2021-33044 (Dahua
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-33044 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Line Argument Parsing) CVE-2021-4034 (Red Hat: Polkit Privilege Escalation) CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory: CVE-2021-33044 (Dahua…
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.