CVE-2021-33045

This flaw is like a door lock that can be tricked—attackers send a special kind of network message during login, and the camera/recorder accepts them as if they were an authorized user. That means someone may be able to watch, control, and potentially keep access through hidden accounts.

This matters if your business uses Dahua cameras/recorders/access control systems running affected firmware in the listed families (ipc-hum7xxx, ipc-hx3xxx, ipc-hx5xxx, nvr-1xxx, nvr-2xxx, nvr-4xxx, nvr-5xxx, nvr-6xx, vth-542xh, vto-65xxx).
It is only a risk when the affected device is reachable over the network (and can be reached by an attacker), and no authentication is needed to attempt the bypass—so a publicly exposed or otherwise reachable device is especially concerning.

Attackers are already using this flaw in real incidents, and CISA has included it in its Known Exploited Vulnerabilities list. Because it allows remote, password-free access on reachable devices, you should treat this as a stop-what-you-are-doing and patch immediately item for any affected Dahua hardware.

Confirm whether you’re exposed

1. Inventory: List every Dahua device on your network and capture: product family (from the affected list) and the exact firmware version.
2. Reachability check: Determine whether each device is reachable from untrusted networks (for example, the public internet, or other networks you don’t control). This vulnerability requires the device to be reachable over the network.
3. Exposure conclusion: If a device is both (a) one of the affected families and (b) reachable over the network, consider it exposed.

Upgrade to the fixed firmware (use the matching family)

• ipc-hum7xxx → fixed in 2.820.0000000.5.r.210705
• ipc-hx3xxx → fixed in 2.800.0000000.29.r.210630
• ipc-hx5xxx → fixed in 2.820.0000000.5.r.210705
• nvr-1xxx → fixed in 4.001.0000005.1.r.210709
• nvr-2xxx → fixed in 4.001.0000000.1.r.210710
• nvr-4xxx → fixed in 4.001.0000005.1.r.210713
• nvr-5xxx → fixed in 4.001.0000000.0.r.210710
• nvr-6xx → fixed in 4.001.0000001.1.r.210716
• vth-542xh → fixed in 4.500.0000002.0.r.210715
• vto-65xxx → fixed in 4.300.0000004.0.r.210715

Patch path and care notes

• Use Dahua’s official upgrade instructions for your model family to avoid bricking the device.
• After upgrade, verify the device is running the expected fixed firmware version from the device’s update/status page.

If you can’t patch immediately

• Apply Dahua’s mitigations per the vendor remediation page: https://www.dahuasecurity.com/support/cybersecurity/details/957.
• Until upgraded, restrict the device so it is not reachable from untrusted networks (for example, block inbound access from the internet and limit access to trusted internal networks only).

After patching

• Check for persistent unauthorized access (the reported campaign installed persistent backdoor accounts). Review user/account lists on the device and remove any unexpected accounts.
• Monitor for repeated or unusual login attempts and abnormal device behavior.

Timing reference (CISA KEV)

• CISA remediation due date for KEV entry: 2024-09-11.

Severity is effectively critical due to unauthenticated remote access: the login process can be bypassed by sending specially crafted network packets (CWE-287). The vulnerability is confirmed exploited: it is in CISA KEV (listed) and real-world reporting describes an active campaign (Operation CameraSwarm) exploiting CVE-2021-33045 using a tool called “p2pwn,” leading to persistent backdoor accounts on thousands of Dahua cameras.

Attack vector: Network access; authentication required: None; user interaction: None; reachable in default config: True. That combination means attackers don’t need credentials or user clicks—only network reachability.

Exploit maturity: Public exploits exist (2 known), and exploitation has been observed in-the-wild, indicating high practical risk.

KEV meaning here: Inclusion in CISA KEV indicates known exploitation in real environments, which raises priority above “theoretical” issues. (EPSS is not used to temper urgency here because exploitation is confirmed by KEV and news.)