CVE-2021-33044: Dahua IP cameras and recorders authentication bypass via crafted packets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote authentication bypass with a 9.8 CVSS score, KEV listing, public exploits and near-maximum EPSS makes this an urgent patch-or-isolate case.

What it is

Multiple Dahua device firmware families contain an improper authentication flaw in the login process, allowing attackers to bypass identity authentication by sending specially constructed data packets. The vulnerability is remotely reachable without credentials and carries a critical CVSS score of 9.8, making it a serious exposure for internet-facing cameras, recorders and intercoms.

Impact

An attacker gains unauthenticated access to the device, which can lead to full compromise of confidentiality, integrity and availability, including device takeover and use as a pivot into the network.

Attack surface

Reached over the network via the login interface with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any device exposing the affected login service, including internet-facing units, is in scope.

Exploitation

The flaw is listed in CISA KEV with a 2024-08-21 addition date and a 2024-09-11 remediation due date, and public exploit references exist on Packet Storm and Full Disclosure. EPSS is 0.99871 (99.963rd percentile), indicating very high predicted exploitation activity.

What to do

• Apply the vendor firmware updates referenced in Dahua security advisory 957 for all affected product families.
• If patching is not possible, remove affected devices from direct internet exposure and place them behind a firewall or VPN.
• Disable or restrict remote login services and unnecessary ports on affected cameras, recorders and intercoms.
• Segment video surveillance devices onto an isolated VLAN with no access to corporate or production networks.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Detection

• Monitor authentication and login logs on Dahua devices for successful logins without valid credentials or anomalous source IPs.
• Alert on unexpected configuration changes, new admin accounts or firmware modifications on surveillance devices.
• Inspect network traffic to device login endpoints for malformed or unusual authentication packets matching public exploit patterns.
• Track outbound connections from camera and recorder VLANs to external hosts as a possible sign of compromise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.