CVE-2021-33044

What it actually does

This is a network-reachable authentication bypass in the Dahua device login process. A remote, unauthenticated attacker can send specially crafted login/authentication packets that cause affected devices to treat the request as authenticated. Successful exploitation can expose camera/NVR functions, configuration data, live or recorded video, account information, and administrative actions without valid credentials. Because the CVSS vector is network, low complexity, no privileges, and no user interaction, exposed devices are high-risk, especially where management interfaces are reachable from the internet or untrusted networks. The supplied affected-product metadata also lists mongodb/mongo (GIT) with fixed commits 7e28f4296a04d858a2e3dd84a1e79c9ba59a9568 and 43d25964249164d76d5e04dd6cf38f6111e21f5f; that mapping is inconsistent with the Dahua-focused vulnerability description and should be verified before being used for asset scoping.

Why it matters to the business

Compromise can allow attackers to view or manipulate surveillance systems, disrupt physical security monitoring, change device settings, create or alter accounts, pivot deeper into networks, or use devices as botnet infrastructure. This vulnerability is listed in CISA KEV, has active exploitation in the wild, and has an extremely high EPSS score of 0.99871, meaning exploitation is highly likely where vulnerable devices are exposed. Although it was published in 2021, it remains operationally important because internet-facing cameras and recorders are often long-lived and under-patched. CISA's KEV remediation due date was 2024-09-11, so organizations subject to KEV-driven timelines should treat remaining exposure as overdue.

How an attack unfolds

An attacker first identifies Dahua cameras, NVRs, DVRs, or embedded web services exposed on common HTTP/HTTPS or device-management ports. They fingerprint the device using banners, web paths, API behavior, or ONVIF-style discovery. If the device is vulnerable, the attacker sends crafted authentication/login traffic that bypasses the normal credential verification step and obtains an authenticated session or equivalent access. With that access, the attacker may enumerate users, retrieve configuration, view video streams, modify recording or network settings, add persistence through account or configuration changes, and use the device as a foothold for scanning or lateral movement. Public reporting and KEV status indicate active in-the-wild exploitation of this vulnerability class against Dahua devices.

How to fix it

Upgrade affected Dahua firmware to a vendor-fixed version for each impacted model. If devices cannot be upgraded immediately, remove management interfaces from the internet, restrict access to trusted administration networks or VPNs, block external access to HTTP/HTTPS/RTSP/ONVIF management ports, disable unnecessary services, and enforce network segmentation for physical-security devices. Rotate device credentials after patching because successful exploitation may have exposed or modified accounts. Review device configuration for unauthorized users, altered network settings, disabled logging, unexpected firmware, and suspicious integrations. For inventories that include the supplied package metadata, verify whether mongodb/mongo (GIT) is actually in scope for this record; if applicable to a source-based dependency workflow, ensure builds include fixed commit 7e28f4296a04d858a2e3dd84a1e79c9ba59a9568 or 43d25964249164d76d5e04dd6cf38f6111e21f5f as appropriate.

How to confirm the fix worked

Confirm each Dahua device model and firmware version against the vendor advisory or fixed firmware matrix. Validate that administrative web/API interfaces are not reachable from the public internet unless protected by an approved access-control layer. From an untrusted network, verify that HTTP/HTTPS device-management ports do not respond or are blocked by firewall policy. From an authorized test network, confirm that unauthenticated requests to management APIs are rejected and that login attempts require valid credentials. Review asset inventories and vulnerability scanner results for Dahua devices, camera/NVR/DVR fingerprints, and stale firmware. Where the supplied mongodb/mongo (GIT) package metadata appears in dependency tools, validate whether it is a false association before closing remediation based only on those commits.

Typical attack path

1. Scan the internet or internal network for Dahua camera/NVR/DVR management interfaces and related HTTP/HTTPS services.
2. Fingerprint the device model, firmware family, and exposed API endpoints.
3. Send crafted login/authentication packets that bypass normal identity verification.
4. Establish an authenticated management session without valid credentials.
5. Access sensitive functions such as configuration retrieval, user enumeration, live video, recording controls, or administrative settings.
6. Optionally change credentials, add accounts, alter network settings, disable logging/recording, or use the device as a pivot point.
7. Continue reconnaissance against adjacent systems or enroll the device into botnet/proxy infrastructure.

How to detect it

To determine whether exploitation already occurred, collect and review Dahua device logs, web access logs if exported through a reverse proxy, firewall logs, IDS/IPS alerts, VPN/bastion logs, configuration backups, and network flow records. Look for unauthenticated or failed-then-successful access to Dahua login/API endpoints, unusual access to configuration or account-management endpoints, new or modified device users, unexpected administrator logins from internet addresses, changes to DNS/gateway/NTP/recording settings, disabled logging, firmware changes, and outbound connections from cameras or recorders to unknown hosts. Network telemetry should be reviewed for scanning followed by HTTP requests to Dahua-specific CGI/RPC paths and then RTSP/video access or configuration pulls. If threat-intelligence tagging is available, correlate activity with known Dahua authentication-bypass exploitation campaigns and botnet-style scanning. Because device logging may be limited or overwritten, prioritize firewall/proxy/NetFlow evidence and compare current device configuration to known-good backups.

• /RPC2_Login
• RPC2_Login
• global.login
• /cgi-bin/configManager.cgi
• /cgi-bin/configManager.cgi?action=getConfig
• /cgi-bin/configManager.cgi?action=getConfig&name=Account
• /cgi-bin/magicBox.cgi
• /cgi-bin/magicBox.cgi?action=getSystemInfo
• /cgi-bin/userManager.cgi
• /cgi-bin/snapshot.cgi
• /cgi-bin/realmonitor.cgi
• /cgi-bin/loadfile.cgi
• /current_config/Account1
• /current_config/Account
• /onvif/device_service
• RTSP DESCRIBE requests to /cam/realmonitor
• User-Agent: Dahua
• Unauthorized access to configManager.cgi
• getConfig&name=Account
• Account1

What your security team should do

• Immediately identify all Dahua cameras, NVRs, DVRs, and related management interfaces, prioritizing internet-facing and third-party-accessible devices.
• Patch affected Dahua firmware or replace unsupported devices; treat unpatched exposure as urgent because the vulnerability is in KEV and has active exploitation with very high EPSS likelihood.
• Remove direct internet access to device management interfaces and require VPN, bastion, or tightly scoped administrative networks.
• Segment surveillance and IoT devices from corporate user, server, and identity-management networks.
• Rotate credentials and audit local users after patching or isolating devices.
• Hunt for historical exploitation using web/API logs, device audit logs, configuration changes, and network telemetry around Dahua management endpoints.
• Check for unauthorized accounts, changed recording schedules, disabled logs, altered DNS/gateway settings, unexpected outbound connections, and firmware/configuration tampering.
• Add monitoring for unauthenticated access attempts to Dahua login/API endpoints and repeated probing of camera/NVR management ports.
• Verify the inconsistency between the Dahua vulnerability description and the supplied mongodb/mongo affected-product metadata before using package data for remediation reporting.