Critical severity9.8CISA KEVNVD Advisory· Published Sep 15, 2021· Updated Jun 17, 2026
CVE-2021-33044
CVE-2021-33044
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
22(expand)+ 1 more
- (no CPE)
- (no CPE)
- cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*Range: <2.820.0000000.5.r.210705
- cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*Range: <2.800.0000000.29.r.210630
- cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*Range: <2.820.0000000.18.r.210705
- cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:sd49_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:*Range: <2.812.0000007.0.r.210706
- cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.6.r.210707
- cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.10.r.210707
- cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.12.r.210707
- cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.10.r.210701
- cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:*Range: <=2.630.0000000.7.r.210707
- cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.9.r.210706
- cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*Range: <4.300.0000004.0.r.210715
- cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*Range: <4.300.0000003.0.r.210714
- cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*Range: <4.500.0000002.0.r.210715
- cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:*Range: <2.630.0000000.8.r.210630
Patches
Vulnerability mechanics
References
4- packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2021/Oct/13nvdExploitMailing ListThird Party Advisory
- www.dahuasecurity.com/support/cybersecurity/details/957nvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
4- Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight SecondsThe Hacker News · Sep 15, 2026
- Dahua Camera Backdoor Survives Password Changes and Factory Resets on Compromised DevicesCyber Security News · Sep 4, 2026
- Threat Actor Hacks 14,000 IP Cameras in Ukraine and RussiaSecurityWeek · Aug 20, 2026
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2PThe Hacker News · Aug 19, 2026