Improper Authentication in Dahua Technology products - CVE-2021-33044

Vulnerability identifier: #VU96446

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33044

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the device.

Dahua DHI-ASI7213Y-V3-T1
Dahua TPC-BF1241
Dahua TPC-SD2221
Dahua TPC-BF5X21
Dahua TPC-SD8X21
Dahua TPC-PT8X21B
Dahua TPC-BF2221
Dahua TPC-BF5X01
Dahua IPC-HX8XXX
Dahua IPC-HX3XXX
Dahua IPC-HX5(4)(3)XXX
Dahua SD1A1
Dahua SD6AL
Dahua SD52C
Dahua SD50
Dahua SD49
Dahua SD22
Dahua IPC-HUM7XXX
Dahua IPC-HX5XXX
Dahua IPC-HX1XXX
Dahua IPC-HX2XXX
Dahua VTO75X95X
Dahua VTO65XXX
Dahua VTH542XH

Install updates from vendor's website.

Dahua DHI-ASI7213Y-V3-T1 - update to 1.000.0000014.0.R.210823
Dahua TPC-BF1241 - update to 2.630.0000000.6.R.210707
Dahua TPC-SD2221 - update to 2.630.0000000.7.R.210707
Dahua TPC-BF5X21 - update to 2.630.0000000.8.R.210630
Dahua TPC-SD8X21 - update to 2.630.0000000.9.R.210706
Dahua TPC-PT8X21B - update to 2.630.0000000.10.R.210701
Dahua TPC-BF2221 - update to 2.630.0000000.10.R.210707
Dahua TPC-BF5X01 - update to 2.630.0000000.12.R.210707
Dahua IPC-HX8XXX - addressed in versions 2.800.0000000.14.R.210720, 3.000.0000000.2.R.210712
Dahua IPC-HX3XXX - addressed in versions 2.800.0000000.29.R.210630, 2.820.0000000.18.R.210705
Dahua IPC-HX5(4)(3)XXX - update to 2.800.0000000.29.R.210630
Dahua SD1A1 - update to 2.812.0000007.0.R.210706
Dahua SD6AL - update to 2.812.0000007.0.R.210706
Dahua SD52C - update to 2.812.0000007.0.R.210706
Dahua SD50 - update to 2.812.0000007.0.R.210706
Dahua SD49 - update to 2.812.0000007.0.R.210706
Dahua SD22 - update to 2.812.0000007.0.R.210706
Dahua IPC-HUM7XXX - update to 2.820.0000000.5.R.210705
Dahua IPC-HX5XXX - update to 2.820.0000000.5.R.210705
Dahua IPC-HX1XXX - update to 2.820.0000000.33.R.210705
Dahua IPC-HX2XXX - update to 2.820.0000000.33.R.210705
Dahua VTO75X95X - update to 4.300.0000003.0.R.210714
Dahua VTO65XXX - update to 4.300.0000004.0.R.210715
Dahua VTH542XH - update to 4.500.0000002.0.R.210715

• Exploit #11817 - CVE-2021-33044 (Dahua IPC/VTH/VTO devices auth bypass exploit) (August 1, 2025)
• Exploit #10422 - DahuaLoginBypass (Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.) (August 23, 2024)

• https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582
• http://seclists.org/fulldisclosure/2021/Oct/13
• http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html

• Authentication bypass in multiple Dahua products