CVE-2021-33044

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-33044 9.8

Dahua · IP Camera Firmware · Added 2024-08-21 · Published 2021-09-15

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityDahua IP Camera Authentication Bypass Vulnerability

VendorDahua

ProductIP Camera Firmware

Date added2024-08-21

Due date2024-09-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

NVD: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-09 22:41 UTC

Wall time45.0s

Searches6

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2021-33044
https://www.dahuasecurity.com/support/cybersecurity/details/957
https://seclists.org/fulldisclosure/2021/Oct/13
https://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
https://github.com/mcw0/DahuaConsole
https://raw.githubusercontent.com/fkie-cad/nvd-json-data-feeds/main/CVE-2021/CVE-2021-330xx/CVE-2021-33044.json

Hunting hypothesis agent

Hunt for global.login JSON-RPC requests with clientType NetKeyboard on DHIP (TCP/5000) or HTTP (TCP/80/443), then correlate with immediate admin session tokens and subsequent config dump or user management commands in access logs.

Research details

Componentdevice authentication module (global.login via DHIP/HTTP protocol)

PreconditionsNetwork reachability to the target device over TCP ports 37777 (DHIP) and/or 80/443 (HTTP/HTTPS); no authentication or prior access required; target device must be running firmware released prior to June 2021 that does not implement NetKeyboard type checking during the global.login sequence agent

DeliveryJSON-RPC global.login request with clientType set to NetKeyboard sent over DHIP (TCP/5000) or HTTP/HTTPS, bypassing authentication and returning a valid admin session token that grants full administrative access to the device

Public PoCyes

PoC URLs https://github.com/mcw0/DahuaConsole
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2021/Oct/13 Third-party repos; verify before use.

Advisoryhttps://www.dahuasecurity.com/support/cybersecurity/details/957

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Exploitation trivial: sending a crafted JSON-RPC global.login payload with clientType set to NetKeyboard bypasses all authentication and returns a valid admin session token

SummaryCVE-2021-33044 is an authentication bypass vulnerability in Dahua IP cameras, NVRs, DVRs, thermal cameras, and door stations (VTO/VTH). The flaw resides in the global.login RPC call handler over DHIP (TCP/37777) and HTTP/HTTPS protocols: setting clientType to "NetKeyboard" causes devices with firmware older than June 2021 to skip authentication and return a valid session token granting full administrative access. Trivially exploitable with no credentials required, the vulnerability was discovered by researcher bashis in 2021, with a public PoC on GitHub (DahuaConsole), and was added to CISA KEV in August 2024. Dahua released firmware updates in September 2021; remediation requires patching all affected devices.

Tia coverage

First reported2026-08-19

First exploit report2026-08-19

Exploit report → KEV728 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.