CVE-2021-33045: Dahua IP Camera Authentication Bypass Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-08-21. EPSS: 99.6% chance of exploitation in the next 30 days.

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Affected products

Dahuasecurity Ipc-HUM7XXX Firmware: before 2.820.0000000.5.r.210705 (fixed in 2.820.0000000.5.r.210705)
Dahuasecurity Ipc-HX3XXX Firmware: before 2.800.0000000.29.r.210630 (fixed in 2.800.0000000.29.r.210630)
Dahuasecurity Ipc-HX5XXX Firmware: before 2.820.0000000.5.r.210705 (fixed in 2.820.0000000.5.r.210705)
Dahuasecurity NVR-1xxx Firmware: before 4.001.0000005.1.r.210709 (fixed in 4.001.0000005.1.r.210709)
Dahuasecurity NVR-2xxx Firmware: before 4.001.0000000.1.r.210710 (fixed in 4.001.0000000.1.r.210710)
Dahuasecurity NVR-4xxx Firmware: before 4.001.0000005.1.r.210713 (fixed in 4.001.0000005.1.r.210713)
Dahuasecurity NVR-5xxx Firmware: before 4.001.0000000.0.r.210710 (fixed in 4.001.0000000.0.r.210710)
Dahuasecurity NVR-6xx Firmware: before 4.001.0000001.1.r.210716 (fixed in 4.001.0000001.1.r.210716)
Dahuasecurity Vth-542xh Firmware: before 4.500.0000002.0.r.210715 (fixed in 4.500.0000002.0.r.210715)
Dahuasecurity Vto-65xxx Firmware: before 4.300.0000004.0.r.210715 (fixed in 4.300.0000004.0.r.210715)
Dahuasecurity Vto-75x95x Firmware: before 4.300.0000003.0.r.210714 (fixed in 4.300.0000003.0.r.210714)
Dahuasecurity Xvr-4x04 Firmware: affected versions not specified; before 4.001.0000001.1.r.210709 (fixed in 4.001.0000001.1.r.210709)
Dahuasecurity Xvr-4x08 Firmware: before 4.001.0000001.1.r.210709 (fixed in 4.001.0000001.1.r.210709)
Dahuasecurity Xvr-5x04 Firmware: before 4.001.0000003.1.r.210710 (fixed in 4.001.0000003.1.r.210710)
Dahuasecurity Xvr-5x08 Firmware: before 4.001.0000003.1.r.210710 (fixed in 4.001.0000003.1.r.210710)
Dahuasecurity Xvr-5x16 Firmware: before 4.001.0000003.1.r.210710 (fixed in 4.001.0000003.1.r.210710)
Dahuasecurity Xvr-7x16 Firmware: before 4.001.0000003.1.r.210710 (fixed in 4.001.0000003.1.r.210710)
Dahuasecurity Xvr-7x32 Firmware: before 4.001.0000003.1.r.210710 (fixed in 4.001.0000003.1.r.210710)

Published 2021-09-15. Last modified 2026-06-17.