CVE-2021-33045

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-33045 9.8

Dahua · IP Camera Firmware · Added 2024-08-21 · Published 2021-09-15

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityDahua IP Camera Authentication Bypass Vulnerability

VendorDahua

ProductIP Camera Firmware

Date added2024-08-21

Due date2024-09-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

NVD: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-10 01:43 UTC

Wall time45.0s

Searches2

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2021-33045
https://www.dahuasecurity.com/support/cybersecurity/details/957
https://seclists.org/fulldisclosure/2021/Oct/13
https://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
https://github.com/mcw0/DahuaConsole
https://raw.githubusercontent.com/fkie-cad/nvd-json-data-feeds/main/CVE-2021/CVE-2021-330xx/CVE-2021-33045.json

Hunting hypothesis agent

Hunt for a global.login JSON-RPC on DHIP (TCP 5000 or 37777) with ipAddr=127.0.0.1, loginType=Loopback, clientType=Local granting an immediate admin session token without credential verification in device or network logs.

Research details

Componentdevice authentication module (global.login via DHIP protocol)

PreconditionsNetwork reachability to the target device over TCP port 37777 (DHIP); no authentication or prior access required; target device must be running firmware released prior to mid-2020 that trusts the loopback device specification during the global.login sequence agent

DeliveryDahuaConsole PoC: sends a global.login JSON-RPC request over DHIP protocol (TCP/5000 or TCP/37777) with params containing ipAddr=127.0.0.1, loginType=Loopback, clientType=Local, and arbitrary userName/password (even plaintext 'admin'); the device treats the connection as originating from the loopback interface and returns result:true with a valid session token (e.g., {"id":1,"params":{"keepAliveInterval":60},"result":true,"session":<id>}). PoC: DahuaConsole --logon loopback.

Public PoCyes

PoC URLs https://github.com/mcw0/DahuaConsole
http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2021/Oct/13 Third-party repos; verify before use.

Advisoryhttps://www.dahuasecurity.com/support/cybersecurity/details/957

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Exploitation trivial: sending a crafted JSON payload in the global.login RPC call with ipAddr set to 127.0.0.1, loginType set to Loopback, and clientType set to Local bypasses all authentication

SummaryCVE-2021-33045 is an authentication bypass vulnerability in Dahua IP cameras, NVRs, DVRs, XVR recorders, and door station devices (VTO/VTH). Discovered and disclosed by researcher bashis alongside CVE-2021-33044, this flaw resides in the device authentication module that handles the global.login RPC call over the DHIP protocol (TCP/37777). When an attacker specifies ipAddr as "127.0.0.1", loginType as "Loopback", and clientType as "Local" during the login sequence, the device treats the connection as originating from the local loopback interface and bypasses authentication entirely, returning a valid session token. The vulnerability affects firmware versions older than mid-2020 and extends to a broader set of device types compared to CVE-2021-33044, including NVR and XVR recorder series in addition to IPC, VTO, and VTH devices. Exploitation is straightforward: the attacker sends a crafted JSON-RPC payload to the device's DHIP service with arbitrary credentials (or even a plaintext password), and the device responds with a session granting full administrative privileges. Public proof-of-concept exploit code is available on GitHub (DahuaConsole by mcw0) and was published via PacketStorm and the Full Disclosure mailing list in October 2021. CISA added this CVE to its Known Exploited Vulnerabilities catalog in August 2024. Dahua's security advisory (details/957) covers both CVE-2021-33044 and CVE-2021-33045, and firmware updates were released in September 2021. The fix requires the device to validate that login requests claiming to be from the loopback interface are genuinely local rather than accepting the loopback flag from any remote client. Given the critical CVSS score of 9.8, trivial exploitation, the availability of public PoC code, and active exploitation in the wild, this vulnerability represents a serious risk to all affected Dahua devices still running outdated firmware.

Tia coverage

First reported2026-08-19

First exploit report2026-08-19

Exploit report → KEV728 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.