CVE-2021-33044

This vulnerability is like a camera’s front door that can be tricked into thinking the visitor is authorized, even when they don’t have valid login credentials. Attackers send special network messages that make the device skip its identity check, letting them take control as if they logged in legitimately. In recent activity, attackers have used similar techniques to install long-lasting “backdoor” access on cameras.

This matters if you use or manage certain Dahua IP camera and recorder firmware families: ipc-hum7xxx, ipc-hx3xxx, ipc-hx5xxx, sd1a1, sd22, sd49, sd50, sd52c, sd6al, or tpc-bf1241.

It is most risky when the device is reachable on the network (and particularly if it is reachable from the internet) because the flaw requires no login and no user action; an attacker only needs network reachability to the vulnerable device using crafted packets.

This is a RED issue because attackers are actively exploiting it in the real world, and it has been confirmed in CISA’s Known Exploited Vulnerabilities list. Automated, internet-based attempts are plausible because exploitation does not require credentials or user interaction. You should treat reachable vulnerable devices as currently at risk and prioritize patching and network lockdown immediately.

1. Identify affected devices

   • Inventory all Dahua devices in your environment.
   • For each device, record the firmware version and ensure it matches one of these affected families: ipc-hum7xxx, ipc-hx3xxx, ipc-hx5xxx, sd1a1, sd22, sd49, sd50, sd52c, sd6al, tpc-bf1241.

2. Check exposure and reachability

   • Determine whether each device is reachable from the internet (via public IP, port forwarding, UPnP, or a remote access setup).
   • Identify open inbound ports/firewall rules that allow direct access to the device’s services from untrusted networks.

3. Upgrade to the fixed firmware (use the vendor-fixed versions)

   • ipc-hum7xxx firmware → 2.820.0000000.5.r.210705
   • ipc-hx3xxx firmware → 2.800.0000000.29.r.210630
   • ipc-hx5xxx firmware → 2.820.0000000.18.r.210705
   • sd1a1 / sd22 / sd49 / sd50 / sd52c / sd6al firmware → 2.812.0000007.0.r.210706
   • tpc-bf1241 firmware → 2.630.0000000.6.r.210707
   • Note: Apply the correct fixed version for the exact firmware family; do not mix versions across unrelated families.

4. If you cannot patch immediately (temporary containment)

   • Remove or disable public exposure: delete port forwards and block inbound traffic to Dahua device ports from the internet.
   • Restrict device access so it is reachable only from your local/management network (or specific trusted IPs) until upgrades are complete.

5. Validate successful remediation

   • After upgrading, attempt normal admin access and confirm the device behaves as expected.
   • Check device access/login logs for evidence of suspicious sessions or unusual access patterns.
   • If your environment uses centralized monitoring, also check alert history around the timeframe when suspicious activity would have occurred.

6. Watch for persistence and follow-up actions

   • Because real-world campaigns have been reported to install persistent backdoors on Dahua IP cameras, treat any suspicious log entries as a potential compromise.
   • If compromise is suspected: isolate the device from the network and follow your incident response playbook (and/or vendor guidance) before reconnecting.

7. Timing guidance

   • CISA due date for action on KEV listing: 2024-09-11.

8. Monitor going forward

   • Keep checking for new firmware updates from Dahua.
   • Monitor firewall logs and device logs for repeated connection attempts from unusual sources.

Severity is critical (CWE-287) with a mechanism of unauthenticated authentication bypass. Attackers exploit the login process by sending specially crafted network packets that bypass the device’s identity authentication checks, allowing unauthorized control without credentials or user interaction.

Exploitation status: confirmed exploited in the wild and listed in CISA KEV (added 2024-08-21) with a CISA remediation due date of 2024-09-11; real-world reporting describes a campaign exploiting CVE-2021-33044 alongside CVE-2021-33045 to install persistent backdoors.

Exploit maturity/availability: a public exploit is available (noted as one known public exploit). EPSS is extremely high in predictions and rising, but public exploitation/KEV-confirmed activity already establishes practical risk.

For remediation, the vendor provides fixed firmware versions by affected family; applying the correct fixed firmware is the primary control, with network reachability reduction as an immediate containment step when upgrades are delayed.