Dahua · IP Camera Firmware
The authentication bypass flaw lies in the login process of certain Dahua IP camera firmware, where device identity verification can be circumvented. An attacker who sends specially constructed data packets can bypass device identity authentication over the network without needing credentials or any user interaction.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 26 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
bypassed login yields valid-looking camera session access
Attackers can bypass device identity authentication
unauthenticated network exploit bypassing login on exposed device; ATT&CK ID T1190 introduces a list containing CVE-2021-33045
identity authentication bypass vulnerability
(Red Hat: Polkit Privilege Escalation) CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory: CVE-2021-33044 (Dahua Security) CVE-2021-33045 (Dahua
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-33045 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
(Red Hat: Polkit Privilege Escalation) CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory: CVE-2021-33044 (Dahua Security) CVE-2021-33045 (Dahua…
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.