cnvd - cnvd-2021-70816

CNVD-2021-70816

Vulnerability from cnvd - Published: 2021-09-14

Title

大华部分产品身份认证绕过漏洞

Description

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。

Severity

高

Patch Name

大华部分产品身份认证绕过漏洞的补丁

Patch Description

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://www.dahuasecurity.com/support/cybersecurity/details/957

Reference

https://www.dahuasecurity.com/support/cybersecurity/details/957

Impacted products

Name
['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before June，2021', '浙江大华技术股份有限公司 PTZ Dome Camera SD1A1 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD22 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD49 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD50 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD52C Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD6AL Versions which Build time before June，2021', '浙江大华技术股份有限公司 Thermal TPC-BF1241 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD8X21 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-PT8X21B Versions which Build time before June，2021']

Name

['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before June，2021', '浙江大华技术股份有限公司 PTZ Dome Camera SD1A1 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD22 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD49 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD50 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD52C Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD6AL Versions which Build time before June，2021', '浙江大华技术股份有限公司 Thermal TPC-BF1241 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD8X21 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-PT8X21B Versions which Build time before June，2021']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-33044"
    }
  },
  "description": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\n\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.dahuasecurity.com/support/cybersecurity/details/957",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-70816",
  "openTime": "2021-09-14",
  "patchDescription": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\r\n\r\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 IPC-HX3XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HX5XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HUM7XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTO75X95X Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  VTO65XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTH542XH Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  PTZ Dome Camera SD1A1 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD22 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD49 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD50 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD52C Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD6AL Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  Thermal TPC-BF1241 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-BF2221 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-SD2221 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  TPC-BF5XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-SD8X21 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-PT8X21B Versions which Build time before June\uff0c2021"
    ]
  },
  "referenceLink": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-10",
  "title": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2021-33044 (GCVE-0-2021-33044)

Vulnerability from cvelistv5 – Published: 2021-09-15 21:36 – Updated: 2025-10-21 23:25

Summary

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Severity ?

No CVSS data available.

CWE

Improper Authentication

Assigner

dahua

References

URL

Tags

	https://www.dahuasecurity.com/support/cybersecuri…	x_refsource_MISC
	http://seclists.org/fulldisclosure/2021/Oct/13	mailing-listx_refsource_FULLDISC
	http://packetstormsecurity.com/files/164423/Dahua…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices	Affected: Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:19.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
          },
          {
            "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044"
              },
              "type": "kev"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-33044",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:59:48.366509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-08-21T00:00:00+00:00",
            "value": "CVE-2021-33044 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-06T16:06:13.000Z",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
        },
        {
          "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2021-33044",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
            },
            {
              "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
            },
            {
              "name": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2021-33044",
    "datePublished": "2021-09-15T21:36:04.000Z",
    "dateReserved": "2021-05-17T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-70816

CVE-2021-33044 (GCVE-0-2021-33044)

Tags

Sightings

Nomenclature