CVE-2021-33044 is a critical authentication bypass in Dahua IP cameras and intercoms. Attackers can gain full admin access without credentials by sending malicious packets. Any device built before June 2021 is vulnerable.
CVSS 8.1–9.0 (Critical). Actively exploited in the wild. No authentication required. Patch or isolate immediately.
Affected Models
The following Dahua device series are confirmed vulnerable if built before June 2021:
| Device Type | Model Series |
|---|---|
| IP Cameras | IPC-HX1XXX, IPC-HX2XXX, IPC-HX3XXX, IPC-HX4XXX, IPC-HX5XXX, IPC-HX8XXX |
| Turret Cameras | IPC-HUM7XXX |
| Video Intercom | VTO75X95X, VTO65XXX, VTH542XH |
| PTZ Domes | SD1A1, SD22, SD49, SD50, SD52C, SD56AL, SD6AL |
| Thermal Cameras | TPC-BF1241, TPC-BF2221, TPC-BF5XXX, TPC-SD2221, TPC-SD8X21, TPC-PT8X21B |
How to Check Your Device
Step 1: Log Into the Web UI
Open a browser and navigate to the device’s IP address. Log in with admin credentials.
Step 2: Navigate to Version Information
Go to Settings > System Information > Version Information. Look for the Build Time field.
Step 3: Compare Build Date
If the Build Time shows a date before June 2021, your device is vulnerable. Any build from June 2021 or later contains the fix.
What the Vulnerability Does
CVE-2021-33044 allows remote attackers to bypass authentication by crafting malicious login packets with the NetKeyboard parameter set during the authentication handshake. No valid credentials, no special privileges, and no user interaction required. Success grants full administrative access.
Once exploited, attackers can view live camera feeds, download recorded video, modify device settings, disable alarms, change passwords, and potentially pivot to other network systems.
Detection & Mitigation
Network Detection
Scan your network with nmap to identify Dahua devices exposing ports 80 (HTTP) and 443 (HTTPS). Look for Dahua-branded services or banner grabbing results matching “Dahua” or device model numbers. Cross-reference any results against the affected model list above.
Log Monitoring
Enable authentication logging on the device if available. Look for failed login attempts, especially those with unusual parameter values or non-standard authentication sequences. Export logs regularly for analysis.
Immediate Actions (No Patch Available Yet)
- Isolate the device to a dedicated VLAN with strict inbound ACLs. Block all external access to ports 80 and 443.
- Disable remote access and cloud features until firmware is patched.
- Change default credentials to a 16+ character password with no dictionary words.
- Monitor for suspicious outbound connections from the device.
- Document the device’s presence and flag it for immediate patching.
Patching
Download Patches
Visit https://www.dahuasecurity.com/support/downloadCenter and search for your exact model number. Download the firmware version dated June 2021 or later. Dahua’s official security advisory is at https://www.dahuasecurity.com/support/cybersecurity/details/957.
Apply Firmware Update
Two methods: (1) Manual upload via Settings > System Information > Firmware Upgrade, or (2) Cloud upgrade if the device supports it. After update, reboot the device and verify the new Build Time in Settings to confirm the patch was applied.
FAQ
Can I test if my device is vulnerable without exploiting it?
No safe unauthenticated test exists. Check the Build Time via the web UI (requires admin login) instead. If it’s before June 2021 and your model is in the affected list, assume it is vulnerable.
If my device is on an isolated VLAN, do I still need to patch?
Yes. Network isolation reduces exposure but does not eliminate the vulnerability. An insider, malware, or lateral movement from a compromised device can still exploit it. Patch as soon as feasible.
What if Dahua has no patch for my device model?
Contact Dahua support directly. If no patch is forthcoming, discontinue use of the device or run it entirely air-gapped (no network connection). Replacement is the safest option.
Is this vulnerability exploited by state-sponsored actors?
Yes. CVE-2021-33044 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited by advanced persistent threat groups. Treat patching as critical infrastructure priority.
References
- Dahua Security Advisory: https://www.dahuasecurity.com/support/cybersecurity/details/957
- Dahua Download Center: https://www.dahuasecurity.com/support/downloadCenter
- CISA KEV Catalog: CVE-2021-33044 (Known Exploited Vulnerability)
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-33044
Leave a Reply