CVE-2021-33045: Dahua IP cameras and NVRs authentication bypass via crafted packets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network authentication bypass, listed in CISA KEV with public exploits and near-maximum EPSS probability.

What it is

Dahua IP cameras, NVRs, XVRs and related devices contain an improper authentication flaw (CWE-287) in the login process. An attacker can bypass device identity authentication by sending specially constructed network packets, gaining access without valid credentials. The flaw is rated CVSS 9.8 critical and affects a broad range of Dahua firmware families.

Impact

An unauthenticated attacker gains full access to the affected device, with high impact to confidentiality, integrity and availability. This can expose live video, allow configuration changes, and provide a foothold into the camera or recorder network.

Attack surface

The flaw is reachable over the network via the device login process, as reflected by the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required; the attacker only needs network reachability to the device's login service.

Exploitation

CVE-2021-33045 is listed in CISA KEV (added 2024-08-21) and has public exploit references, and EPSS shows a 30-day probability of 0.99556 (99.9th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor's fixed firmware per the Dahua security advisory (details/957) for all listed camera, NVR, XVR, VTO and VTH models.
• If patching is not possible, isolate affected devices on a segmented network with no internet exposure and restrict management access to trusted hosts.
• Disable or block remote access to the device login service from untrusted networks using firewall rules.
• Replace or discontinue devices that cannot be updated, per CISA KEV required action.
• Monitor vendor advisories for updated firmware and re-check affected model coverage.

Detection

• Monitor authentication and login logs on Dahua devices for successful logins without a preceding valid credential exchange or from unexpected source IPs.
• Alert on anomalous or malformed packets directed at the device login service, including repeated connection attempts from a single external host.
• Baseline normal management traffic and flag new external IPs reaching camera/NVR management ports.
• Review network flow logs for affected device models communicating with untrusted external addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.