cnvd - cnvd-2021-70815

CNVD-2021-70815

Vulnerability from cnvd - Published: 2021-09-14

Title

大华部分产品身份认证绕过漏洞（CNVD-2021-70815）

Description

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。

Severity

高

Patch Name

大华部分产品身份认证绕过漏洞（CNVD-2021-70815）的补丁

Patch Description

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://www.dahuasecurity.com/support/cybersecurity/details/957

Reference

https://www.dahuasecurity.com/support/cybersecurity/details/957

Impacted products

Name
['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before December，2019', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR1XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR2XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR5XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR6XX Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR4xxx Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR5xxx Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR7xxx Versions which Build time before December，2019']

Name

['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before May，2020', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before December，2019', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR1XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR2XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR5XXX Versions which Build time before December，2019', '浙江大华技术股份有限公司 NVR6XX Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR4xxx Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR5xxx Versions which Build time before December，2019', '浙江大华技术股份有限公司 XVR7xxx Versions which Build time before December，2019']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-33045"
    }
  },
  "description": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\n\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.dahuasecurity.com/support/cybersecurity/details/957",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-70815",
  "openTime": "2021-09-14",
  "patchDescription": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\r\n\r\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2021-70815\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 IPC-HX3XXX Versions which Build time before May\uff0c2020",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HX5XXX Versions which Build time before May\uff0c2020",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HUM7XXX Versions which Build time before May\uff0c2020",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTO75X95X Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  VTO65XXX Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTH542XH Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 NVR1XXX Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 NVR2XXX Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 NVR5XXX Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 NVR6XX Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 XVR4xxx Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 XVR5xxx Versions which Build time before December\uff0c2019",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 XVR7xxx Versions which Build time before December\uff0c2019"
    ]
  },
  "referenceLink": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-10",
  "title": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2021-70815\uff09"
}

CVE-2021-33045 (GCVE-0-2021-33045)

Vulnerability from cvelistv5 – Published: 2021-09-15 21:50 – Updated: 2025-10-21 23:25

Summary

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Severity ?

No CVSS data available.

CWE

Improper Authentication

Assigner

dahua

References

URL

Tags

	https://www.dahuasecurity.com/support/cybersecuri…	x_refsource_MISC
	http://seclists.org/fulldisclosure/2021/Oct/13	mailing-listx_refsource_FULLDISC
	http://packetstormsecurity.com/files/164423/Dahua…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Some Dahua IP Camera, Video Intercom, NVR, XVR devices	Affected: Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:19.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
          },
          {
            "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045"
              },
              "type": "kev"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-33045",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T15:03:50.889187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.413Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-08-21T00:00:00+00:00",
            "value": "CVE-2021-33045 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Some Dahua IP Camera, Video Intercom, NVR, XVR devices",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-06T16:06:10.000Z",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
        },
        {
          "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2021-33045",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Some Dahua IP Camera, Video Intercom, NVR, XVR devices",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX Buildtime before May, 2020, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, NVR devices NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, XVR devices XVR4xxx, XVR5xxx, and XVR7xxx Buildtime before December, 2019."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
            },
            {
              "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
            },
            {
              "name": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2021-33045",
    "datePublished": "2021-09-15T21:50:08.000Z",
    "dateReserved": "2021-05-17T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-70815

CVE-2021-33045 (GCVE-0-2021-33045)

Tags

Sightings

Nomenclature