jvndb - jvndb-2024-000007

jvndb-2024-000007

Vulnerability from jvndb

Published

2024-01-18 13:43

Modified

2024-07-11 16:10

Severity ?

8.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple Dahua Technology products vulnerable to authentication bypass

Details

Multiple products provided by Dahua Technology contain an authentication bypass vulnerability (CWE-287). Mitsui Bussan Secure Directions, Inc. reported the vulnerability existed in "DHI-ASI7213Y-V3-T1" to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN83655695/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2021-33044
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-33044
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Dahua Technology Co., Ltd	DHI-ASI7213Y-V3-T1
	Dahua Technology Co., Ltd	IPC-HUM7XXX
	Dahua Technology Co., Ltd	IPC-HX1XXX
	Dahua Technology Co., Ltd	IPC-HX2XXX
	Dahua Technology Co., Ltd	IPC-HX3XXX
	Dahua Technology Co., Ltd	IPC-HX5(4)(3)XXX
	Dahua Technology Co., Ltd	IPC-HX5XXX
	Dahua Technology Co., Ltd	IPC-HX8XXX
	Dahua Technology Co., Ltd	PTZ Dome Camera SD1A1
	Dahua Technology Co., Ltd	PTZ Dome Camera SD22
	Dahua Technology Co., Ltd	PTZ Dome Camera SD49
	Dahua Technology Co., Ltd	PTZ Dome Camera SD50
	Dahua Technology Co., Ltd	PTZ Dome Camera SD52C
	Dahua Technology Co., Ltd	PTZ Dome Camera SD6AL
	Dahua Technology Co., Ltd	Thermal TPC-BF1241
	Dahua Technology Co., Ltd	Thermal TPC-BF2221
	Dahua Technology Co., Ltd	Thermal TPC-BF5XXX
	Dahua Technology Co., Ltd	Thermal TPC-SD2221
	Dahua Technology Co., Ltd	Thermal TPC-PT8X21B
	Dahua Technology Co., Ltd	Thermal TPC-SD8X21
	Dahua Technology Co., Ltd	VTH542XH
	Dahua Technology Co., Ltd	VTO65XXX
	Dahua Technology Co., Ltd	VTO75X95X

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000007.html",
  "dc:date": "2024-07-11T16:10+09:00",
  "dcterms:issued": "2024-01-18T13:43+09:00",
  "dcterms:modified": "2024-07-11T16:10+09:00",
  "description": "Multiple products provided by Dahua Technology contain an authentication bypass vulnerability (CWE-287).\r\n\r\nMitsui Bussan Secure Directions, Inc. reported the vulnerability existed in \"DHI-ASI7213Y-V3-T1\" to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000007.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:dahuasecurity:dhi-asi7213y-v3-t1_firmware",
      "@product": "DHI-ASI7213Y-V3-T1",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hum7xxx_firmware",
      "@product": "IPC-HUM7XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx1xxx_firmware",
      "@product": "IPC-HX1XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx2xxx_firmware",
      "@product": "IPC-HX2XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx3xxx_firmware",
      "@product": "IPC-HX3XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx5%284%29%283%29xxx_firmware",
      "@product": "IPC-HX5(4)(3)XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx5xxx_firmware",
      "@product": "IPC-HX5XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ipc-hx8xxx_firmware",
      "@product": "IPC-HX8XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd1a1_firmware",
      "@product": "PTZ Dome Camera SD1A1",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd22_firmware",
      "@product": "PTZ Dome Camera SD22",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd49_firmware",
      "@product": "PTZ Dome Camera SD49",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd50_firmware",
      "@product": "PTZ Dome Camera SD50",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd52c_firmware",
      "@product": "PTZ Dome Camera SD52C",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:ptz-dome-camera-sd6al_firmware",
      "@product": "PTZ Dome Camera SD6AL",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf1241_firmware",
      "@product": "Thermal TPC-BF1241",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf2221_firmware",
      "@product": "Thermal TPC-BF2221",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-bf5xxx_firmware",
      "@product": "Thermal TPC-BF5XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd2221_firmware",
      "@product": "Thermal TPC-SD2221",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd8x21b_firmware",
      "@product": "Thermal TPC-PT8X21B",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:thermal-tpc-sd8x21_firmware",
      "@product": "Thermal TPC-SD8X21",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vth-542xh_firmware",
      "@product": "VTH542XH",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vto-65xxx_firmware",
      "@product": "VTO65XXX",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:dahuasecurity:vto-75x95x_firmware",
      "@product": "VTO75X95X",
      "@vendor": "Dahua Technology Co., Ltd",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "7.6",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
      "@version": "2.0"
    },
    {
      "@score": "8.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2024-000007",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN83655695/index.html",
      "@id": "JVN#83655695",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2021-33044",
      "@id": "CVE-2021-33044",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-33044",
      "@id": "CVE-2021-33044",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "Multiple Dahua Technology products vulnerable to authentication bypass"
}

cve-2021-33044

Vulnerability from cvelistv5

Published

2021-09-15 21:36

Modified

2024-09-05 15:00

Severity ?

Summary

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

References

▼	URL	Tags
	https://www.dahuasecurity.com/support/cybersecurity/details/957	x_refsource_MISC
	http://seclists.org/fulldisclosure/2021/Oct/13	mailing-list, x_refsource_FULLDISC
	http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:19.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
          },
          {
            "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-21",
                "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
              },
              "type": "kev"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-33044",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:59:48.366509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T15:00:36.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-06T16:06:13",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
        },
        {
          "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2021-33044",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
            },
            {
              "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
            },
            {
              "name": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2021-33044",
    "datePublished": "2021-09-15T21:36:04",
    "dateReserved": "2021-05-17T00:00:00",
    "dateUpdated": "2024-09-05T15:00:36.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted