CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2021-33044

CVSS 9.8v3.1pub. 2021-09-15upd. 2026-01-13

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dahuasecurity Ipc Hum7xxx

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Ipc Hum7xxx Firmware

    OS
    Dahuasecurity
    < 2.820.0000000.5.r.210705

  • Dahuasecurity Ipc Hx3xxx

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Ipc Hx3xxx Firmware

    OS
    Dahuasecurity
    < 2.800.0000000.29.r.210630

  • Dahuasecurity Ipc Hx5xxx

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Ipc Hx5xxx Firmware

    OS
    Dahuasecurity
    < 2.820.0000000.18.r.210705

  • Dahuasecurity Sd1a1

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd1a1 Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Sd22

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd22 Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Sd49

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd49 Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Sd50

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd50 Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Sd52c

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd52c Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Sd6al

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Sd6al Firmware

    OS
    Dahuasecurity
    < 2.812.0000007.0.r.210706

  • Dahuasecurity Tpc Bf1241

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Bf1241 Firmware

    OS
    Dahuasecurity
    < 2.630.0000000.6.r.210707

  • Dahuasecurity Tpc Bf2221

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Bf2221 Firmware

    OS
    Dahuasecurity
    < 2.630.0000000.10.r.210707

  • Dahuasecurity Tpc Bf5x01

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Bf5x01 Firmware

    OS
    Dahuasecurity
    < 2.630.0000000.12.r.210707

  • Dahuasecurity Tpc Bf5x21

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Bf5x21 Firmware

    OS
    Dahuasecurity
    < 2.630.0000000.8.r.210630

  • Dahuasecurity Tpc Pt8x21b

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Pt8x21b Firmware

    OS
    Dahuasecurity
    < 2.630.0000000.10.r.210701

  • Dahuasecurity Tpc Sd2221

    HW
    Dahuasecurity
    all versions

  • Dahuasecurity Tpc Sd2221 Firmware

    OS
    Dahuasecurity
    ≤ 2.630.0000000.7.r.210707

CISA KEV — detailsi

Vendori
Dahua
Producti
IP Camera Firmware
Added to KEVi
August 21, 2024
Remediation deadline (US Federal)i
September 11, 2024(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 11 września 2024
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2021-33045CRITICAL9.8⚠ KEVPL ✓same product

Pominięcie uwierzytelnienia w urządzeniach Dahua podczas logowania

CVE-2021-33046CRITICAL9.8PL ✓same product

Obejście uwierzytelniania w procesie resetowania hasła w urządzeniach Dahua

CVE-2020-9502CRITICAL9.8PL ✓same product

Przewidywalne Session ID w urządzeniach Dahua — podatność CRITICAL

CVE-2019-9682HIGH8.1same product

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to ...

CVE-2020-9499HIGH7.2same product

Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the...