CVE-2021-33044

{"id": "CVE-2021-33044", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-09-15T22:15:10.497", "references": [{"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cybersecurity@dahuatech.com"}, {"url": "http://seclists.org/fulldisclosure/2021/Oct/13", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cybersecurity@dahuatech.com"}, {"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957", "tags": ["Vendor Advisory"], "source": "cybersecurity@dahuatech.com"}, {"url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2021/Oct/13", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.dahuasecurity.com/support/cybersecurity/details/957", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n de identidad encontrada en algunos productos Dahua durante el proceso de inicio de sesi\u00f3n. Los atacantes pueden omitir la autenticaci\u00f3n de la identidad del dispositivo al construir paquetes de datos maliciosos"}], "lastModified": "2024-11-21T06:08:10.943", "cisaActionDue": "2024-09-11", "cisaExploitAdd": "2024-08-21", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0356805-3ECF-4C6F-B2BF-95D507736C44", "versionEndExcluding": "2.820.0000000.5.r.210705"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5AE9ACB0-4CB3-4CF5-A007-15EE977D782E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0D17050-41CA-4808-8ED3-F332FD00B551", "versionEndExcluding": "2.800.0000000.29.r.210630"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8936A118-4AB5-4B09-A9FD-E624A68315BD"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04346BB7-74D1-46C4-B058-076B16C0209F", "versionEndExcluding": "2.820.0000000.18.r.210705"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F2838BDA-97FF-498E-BC81-955D31B9227A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BA2AB22-37B0-471F-B6E4-BB3F3A6FB817", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd1a1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "88AD58DE-D990-4C98-853B-21B79CD07EEC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17FADF4C-29F2-449A-B57E-59F2338D433C", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd22:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "428852DE-BDE3-4CE4-972C-821E88C7F930"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd41_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E306AAC-7BCD-4A76-8C7B-8399B54E12CE", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd41:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "61F87969-66DA-45EF-861C-3D3189388160"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69712780-BA39-4B2E-810C-E9BCF6E213F1", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "984AD4D5-D689-4150-A1EE-D48B81CBB7C8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69E7E0D4-7E9B-4580-B28A-898146DED548", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd52c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5BA0D206-5BE7-4592-8D3E-641F47164770"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41A67081-5051-47A0-A0EA-1C41A78F5C9A", "versionEndExcluding": "2.812.0000007.0.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:sd6al:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C35F4371-334B-4EA8-8F48-498C81652F7C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "468FD434-642E-4613-B720-84254D9B9960", "versionEndExcluding": "2.630.0000000.6.r.210707"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-bf1241:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "73B58CBF-EB67-4F02-BBAE-FFC329B8873C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C24A62B1-EFFA-4D22-ACB3-A645B325C280", "versionEndExcluding": "2.630.0000000.10.r.210707"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-bf2221:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E314BF6-76B4-4ADB-B555-7DAF92F60485"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C60703FA-F833-472C-84FC-2366409F484B", "versionEndExcluding": "2.630.0000000.12.r.210707"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-bf5x01:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7EA0704-EC7A-457A-9AC1-A39B07229DFE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EED64E60-F703-4116-9F34-7FDBD6906E33", "versionEndExcluding": "2.630.0000000.10.r.210701"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-pt8x21b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8DABC76F-9824-43F3-B230-656F6C99CDA8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F49DC7A3-6FBB-4B52-848C-50EEAEFBF0B0", "versionEndIncluding": "2.630.0000000.7.r.210707"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-sd2221:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D166CD0E-92CC-44FA-A520-FFFEBE2D7D50"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF2B9320-63F7-4076-B60B-674CBADC2235", "versionEndExcluding": "2.630.0000000.9.r.210706"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-sd8x21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "75A88A53-91D8-4019-95EB-F6FEFF469F9A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AC98964-DBDE-438C-A0E7-BF11D1BBC4B0", "versionEndExcluding": "4.300.0000004.0.r.210715"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9438ADC0-C8F4-48E1-A905-9914A3AE715E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3FFF94A-7F57-49D2-A6BA-5B58064C41C5", "versionEndExcluding": "4.300.0000003.0.r.210714"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B205125D-5A33-49B0-A2BA-BD833D107924"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F1138DD-7149-4191-BF6B-5176B8EF3A07", "versionEndExcluding": "4.500.0000002.0.r.210715"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "72039FDA-344D-4961-BB1B-E6F32EAFD7C2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADA22FE4-6663-4852-9D82-F311520BB4D6", "versionEndExcluding": "2.630.0000000.8.r.210630"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dahuasecurity:tpc-bf5x21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4A693D2B-F82D-41C8-A219-532CB5FD1FB6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@dahuatech.com", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Dahua IP Camera Authentication Bypass Vulnerability"}