CVE-2021-33045

Dahua IP cameras, network recorders and video-intercom devices are affected by a critical identity authentication bypass (CWE-287) in the login process. By constructing malicious data packets sent to a device during the login process, an attacker can bypass device identity authentication entirely, yielding full unauthenticated access with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw spans a broad set of Dahua firmware, including IPC-HUM7xxx/HX3xxx/HX5xxx cameras, NVR-1xxx/2xxx/4xxx/5xxx/6xx and XVR-4x04 recorders, and the VTH-542XH, VTO-65xxx and VTO-75x95x video-intercom units. Public proof-of-concept exploits have been available since October 2021, and CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-08-21; public reporting describes 14,500+ Dahua devices compromised via credential attacks, auth bypasses and P2P abuse, and EPSS assigns a 99.6% probability of exploitation within 30 days.

What to do: Upgrade affected IPC, NVR, XVR, VTO and VTH devices to the fixed firmware listed in Dahua's security bulletin for CVE-2021-33045, or apply vendor-recommended mitigations — CISA's required action is to apply vendor mitigations or discontinue use of the product. Until patched, restrict internet exposure of device login/management interfaces and P2P connectivity, and audit affected fleets for signs of compromise (unexpected logins or P2P sessions) given the reported 14,500+ device campaign.