CVE-2021-33045

What it actually does

CVE-2021-33045 is a network-exploitable authentication bypass in the login process of multiple Dahua IP cameras, NVRs, XVRs, video intercoms, and related firmware families. An unauthenticated attacker can send specially crafted login packets to bypass identity verification and obtain access as if authenticated. Because the vulnerable devices commonly expose administrative web/API interfaces, successful exploitation can allow full device control, access to live or recorded video, configuration changes, credential extraction or modification, firmware/configuration tampering, and potential pivoting into adjacent networks. The vulnerability has a CVSS score of 9.8, very high EPSS likelihood, and is listed in CISA KEV with confirmed exploitation in the wild.

Why it matters to the business

Compromise of affected Dahua surveillance and access-control devices can disrupt physical security operations, expose sensitive video feeds, enable tampering with recordings or camera coverage, and provide attackers with a foothold inside operational or corporate networks. Because exploitation is unauthenticated, remotely reachable devices are at high risk, especially where management interfaces are exposed to the internet. The vulnerability is known exploited and was subject to a CISA KEV remediation deadline of 2024-09-11, making unresolved exposure a material operational and compliance risk.

How an attack unfolds

An attacker first identifies internet-facing or internally reachable Dahua devices from affected IPC, NVR, XVR, VTH, or VTO product families. They then interact with the device login service and submit crafted authentication data that abuses the vulnerable login validation logic. Instead of needing valid credentials, the attacker causes the device to accept the request and establish an authenticated session. With that session, the attacker can access administrative APIs or web functions, view video streams, alter device settings, add or change users, export configuration, disable recording, upgrade or replace firmware where permitted, or use the device as a persistence and reconnaissance point. Public exploit knowledge and high EPSS scoring mean exploitation is often automated through scanning campaigns targeting exposed Dahua management interfaces.

How to fix it

Upgrade affected Dahua firmware to a vendor-fixed release for the specific product model and hardware revision. Because no exact fixed versions were provided in the input, administrators should consult Dahua security advisories and model-specific firmware pages for IPC-HUM7xxx, IPC-HX3xxx, IPC-HX5xxx, NVR-1xxx, NVR-2xxx, NVR-4xxx, NVR-5xxx, NVR-6xx, VTH-542XH, VTO-65xxx, VTO-75X95X, XVR-4X04, XVR-4X08, and related affected firmware families. If immediate upgrade is not possible, remove device management interfaces from the internet, restrict access to trusted management networks or VPNs, block inbound access at firewalls, disable unused services, enforce strong unique credentials, rotate all device credentials after patching, and monitor for unauthorized accounts or configuration changes. Treat exposed unpatched devices as high-risk and prioritize them ahead of devices already isolated on trusted networks.

How to confirm the fix worked

Confirm each device model and firmware version against Dahua’s advisory and verify that installed firmware is at or above the vendor-fixed release for that exact model. Validate that management interfaces are not reachable from the public internet unless explicitly required and protected by compensating controls. From a trusted testing network, attempt only authorized validation using a safe vulnerability scanner or vendor-recommended assessment method that checks for the authentication-bypass condition without changing device state. Review device user lists, configuration exports, firmware integrity, and recent login/session history after remediation. Confirm that firewall, ACL, VPN, or network segmentation controls prevent access to web/API management ports from untrusted networks.

Typical attack path

1. Scan for Dahua camera, NVR, XVR, VTH, or VTO management interfaces exposed over HTTP/HTTPS or reachable from a compromised network segment.
2. Fingerprint the device family, firmware behavior, or login API to confirm it resembles an affected Dahua product.
3. Send crafted login/authentication packets to the device login endpoint to bypass identity authentication.
4. Obtain an authenticated session token, cookie, or API session without valid credentials.
5. Use administrative web/API functions to view streams, retrieve configuration, modify accounts, disable recording, or alter device settings.
6. Optionally establish persistence by creating accounts, changing configuration, uploading firmware where supported, or using the device for further network reconnaissance.

How to detect it

Investigate whether affected Dahua devices received suspicious login/API traffic before patching or isolation. Useful sources include device web access logs, device event/audit logs, authentication/session logs, configuration-change logs, firmware-update logs, firewall and reverse-proxy logs, IDS/IPS events, VPN logs, and NetFlow/DNS telemetry. Look for POST requests to Dahua login endpoints from unfamiliar external IPs, bursts of login API calls, authentication success without corresponding valid user behavior, administrative actions immediately following unusual login requests, access from geographies or networks not associated with administrators, configuration exports, new user creation, password changes, recording schedule changes, disabled channels, time changes, firmware uploads, or unexpected outbound connections from the device. Compare account lists and configuration backups against known-good baselines. For internet-exposed devices, assume opportunistic scanning is likely and prioritize forensic review around the first observed exposure window and any periods of anomalous HTTP/API access.

• POST /RPC2_Login
• /RPC2_Login
• "method":"global.login"
• "clientType":"Web3.0"
• "authorityType":"Default"
• "passwordType":"Default"
• "params":{"userName":"admin"
• "password":"Not Used"
• /cgi-bin/magicBox.cgi
• /cgi-bin/configManager.cgi
• /cgi-bin/userManager.cgi
• /cgi-bin/snapshot.cgi
• /cgi-bin/mjpg/video.cgi
• /cgi-bin/recordFinder.cgi
• /cgi-bin/RPC_Loadfile
• /current_config/passwd

What your security team should do

• Immediately inventory Dahua cameras, NVRs, XVRs, video intercoms, and firmware versions across internet-facing and internal networks.
• Prioritize remediation for any affected Dahua management interface reachable from the internet or from broadly accessible internal networks.
• Upgrade affected devices to the vendor-fixed firmware for the exact model and hardware revision; where upgrades are unavailable, isolate or replace the device.
• Block direct internet access to device management interfaces and require VPN or dedicated management network access.
• Rotate Dahua device passwords, API credentials, and any reused credentials after patching, especially on devices that were exposed while vulnerable.
• Review device accounts, permissions, recording settings, time settings, network settings, and firmware state for unauthorized changes.
• Enable centralized logging where supported and retain web/API access logs, device event logs, firewall logs, and network telemetry for investigation.
• Hunt for unauthenticated or anomalous login API activity, especially repeated requests to Dahua login endpoints followed by administrative actions.
• Treat unexplained account creation, configuration export, stream access, recording disablement, or firmware changes as potential compromise indicators.
• Because this vulnerability is in CISA KEV and has very high exploitation likelihood, track remediation as an urgent vulnerability-management exception until all exposed assets are patched, isolated, or decommissioned.