Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33045)

What is affected, what to do

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Some Dahua IP Camera, Video Intercom, NVR, XVR devices eq Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VT..Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VT

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Build an inventory of every Dahua device in scope (IPC-HX3XXX, IPC-HX5XXX, IPC-HUM7XXX, NVR-1xxx/2xxx/4xxx/5xxx, XVR, VTO/VTH intercoms) and compare firmware against the fixed builds: IPC-HX3XXX ≥ 2.800.0000000.29.r.210630, IPC-HX5XXX / IPC-HUM7XXX ≥ 2.820.0000000.5.r.210705, NVR-1xxx ≥ 4.001.0000005.1.r.210709, NVR-2xxx ≥ 4.001.0000000.1.r.210710, NVR-4xxx ≥ 4.001.0000005.1.r.210713, NVR-5xxx ≥ 4.001.0000000.0.r.210710. Any device with a buildtime before May 2020 is vulnerable.
   • Deploy the vendor firmware now; for end-of-life models, schedule hardware replacement because no further patch is coming.
   • Immediately drop any internet exposure on TCP 80/443/37777/37778 (HTTP/HTTPS/DHIP); run a Shodan/Censys sweep of your own public IP ranges and close every hit.
   • Rotate default and operational accounts (admin, 888888, 666666) and reset every locally stored credential — a successful bypass renders prior passwords moot.
   • Move the devices into an isolated camera VLAN with no outbound internet route and no east-west path into production or office networks; expose management only via jump host or VPN.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: dedicated video VLAN, ACL permits only the VMS/NVR server as client on 37777/80/443; all other sources (including corporate WLAN) are dropped at the core switch or firewall.
   • Perimeter: fully block inbound traffic to Dahua ports; audit and remove NAT/port-forwarding rules on Fortigate, pfSense, Checkpoint, etc.
   • WAF or reverse proxy in front of the web UI if remote access is unavoidable: block login payloads containing "loopback" or "clientType":"Loopback"; enforce HTTP Basic in front, rate-limit /RPC2 and /RPC_Loadfile.
   • Enable IPS/Snort/Suricata signatures for CVE-2021-33045 and the related CVE-2021-33044 (Talos and ET Open have published rules), alert on DHIP login packets with anomalous authentication fields.
   • Device hardening: disable UPnP, P2P (easy4ip), ONVIF discovery and Telnet/SSH; restrict NTP, syslog export and SNMP to internal targets.
   • IAM: separate service accounts per VMS integration, no shared admin logins; document a four-eyes rule for firmware deployments to satisfy NIS2 Article 21 hygiene requirements.
3. 03

   Runbook step 3

   Detection rules

   • Network/Zeek-HTTP or Suricata: POST requests against /RPC2 or /RPC2_Login whose JSON body contains the strings "loopback" or "clientType":"Loopback" — high-priority alert.
   • Suricata rule shape: alert tcp any any -> $CAMERA_NET [80,443,37777] (msg:"Dahua Auth Bypass CVE-2021-33045 loopback indicator"; content:"loopback"; nocase; content:"login"; nocase; sid:1000045;)
   • Camera syslog shipped to SIEM: login events whose source address is 127.0.0.1 while the TCP session originated on an external interface (RemoteIP ≠ 127.0.0.1 but LogonIP = 127.0.0.1) — the classic loopback-spoof signal.
   • NetFlow/firewall: unexpected outbound connections from cameras (SOCKS, Tor guards, mining pools, known Mirai/Hajime C2) — cameras should only talk to the NVR/VMS.
   • VMS audit trail: newly created users, unexpected firmware uploads, stream exports to unknown RTSP targets; KQL/Splunk sketch: index=camera sourcetype=dahua "user_add" OR "firmware_upgrade" OR action="config_change" NOT src_ip IN (<admin_jumphosts>).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Source: pwn.watch, CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Dahua Ipc-hx3xxx Firmware
• Dahua Ipc-hx5xxx Firmware

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• dahuasecurity.comsupport/cybersecurity/details/957x_refsource_MISC, Vendor advisory
• seclists.org20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)Mailing list, x_refsource_FULLDISC, Exploit, Mailing list, Third-party advisory
• packetstormsecurity.comfiles/164423/Dahua-Authentication-Bypass.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045government-resource, US government resource
• pwn.watchpwn.watch: Dahua IP Camera Firmware: 2 actively exploited vulnerabilitiespwn-watch
• dahuasecurity.comDahua advisory: CVE-2021-33044pwn-watch
• NVD (NIST)NVD: CVE-2021-33044pwn-watch
• NVD (NIST)NVD: CVE-2021-33045pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
• pwn.watchpwn.watch: Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warnspwn-watch
• itweek.com.uaЗловмисники можуть отримати контроль над камерами та відеореєстраторами Dahua через хмарний доступ (CERT-UA warning)pwn-watch
• hunt.ioOperation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russiapwn-watch
• therecord.mediaUkraine warns hackers are exploiting Chinese-made Dahua surveillance cameraspwn-watch
• thehackernews.comAttackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknessespwn-watch