cnvd - cnvd-2021-70816

cnvd-2021-70816

Vulnerability from cnvd

Title: 大华部分产品身份认证绕过漏洞

Description:

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。

大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。

Severity: 高

Patch Name: 大华部分产品身份认证绕过漏洞的补丁

Patch Description:

浙江大华技术股份有限公司是一家领先的监控产品供应商和解决方案服务商。

大华部分产品存在身份认证绕过漏洞，攻击者可利用漏洞通过构造恶意数据包绕过设备身份认证。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://www.dahuasecurity.com/support/cybersecurity/details/957

Reference: https://www.dahuasecurity.com/support/cybersecurity/details/957

Impacted products

Name
['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before June，2021', '浙江大华技术股份有限公司 PTZ Dome Camera SD1A1 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD22 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD49 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD50 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD52C Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD6AL Versions which Build time before June，2021', '浙江大华技术股份有限公司 Thermal TPC-BF1241 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD8X21 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-PT8X21B Versions which Build time before June，2021']

Name

['浙江大华技术股份有限公司 IPC-HX3XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HX5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 HUM7XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO75X95X Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTO65XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 VTH542XH Versions which Build time before June，2021', '浙江大华技术股份有限公司 PTZ Dome Camera SD1A1 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD22 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD49 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD50 Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD52C Versions which Build time before June，2021', '浙江大华技术股份有限公司 SD6AL Versions which Build time before June，2021', '浙江大华技术股份有限公司 Thermal TPC-BF1241 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD2221 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-BF5XXX Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-SD8X21 Versions which Build time before June，2021', '浙江大华技术股份有限公司 TPC-PT8X21B Versions which Build time before June，2021']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-33044"
    }
  },
  "description": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\n\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.dahuasecurity.com/support/cybersecurity/details/957",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-70816",
  "openTime": "2021-09-14",
  "patchDescription": "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8\u662f\u4e00\u5bb6\u9886\u5148\u7684\u76d1\u63a7\u4ea7\u54c1\u4f9b\u5e94\u5546\u548c\u89e3\u51b3\u65b9\u6848\u670d\u52a1\u5546\u3002\r\n\r\n\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u6076\u610f\u6570\u636e\u5305\u7ed5\u8fc7\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 IPC-HX3XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HX5XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 HUM7XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTO75X95X Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  VTO65XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 VTH542XH Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  PTZ Dome Camera SD1A1 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD22 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD49 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD50 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD52C Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 SD6AL Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  Thermal TPC-BF1241 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-BF2221 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-SD2221 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8  TPC-BF5XXX Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-SD8X21 Versions which Build time before June\uff0c2021",
      "\u6d59\u6c5f\u5927\u534e\u6280\u672f\u80a1\u4efd\u6709\u9650\u516c\u53f8 TPC-PT8X21B Versions which Build time before June\uff0c2021"
    ]
  },
  "referenceLink": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-10",
  "title": "\u5927\u534e\u90e8\u5206\u4ea7\u54c1\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2021-33044 (GCVE-0-2021-33044)

Vulnerability from cvelistv5

Published

2021-09-15 21:36

Modified

2025-07-30 01:37

Severity ?

CWE

Improper Authentication

Summary

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

References

▼	URL	Tags
	https://www.dahuasecurity.com/support/cybersecurity/details/957	x_refsource_MISC
	http://seclists.org/fulldisclosure/2021/Oct/13	mailing-list, x_refsource_FULLDISC
	http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices	Version: Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:19.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
          },
          {
            "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044"
              },
              "type": "kev"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-33044",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:59:48.366509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:37:58.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2024-08-21T00:00:00+00:00",
            "value": "CVE-2021-33044 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-06T16:06:13.000Z",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
        },
        {
          "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2021-33044",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Dahua IP Camera devices IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Video Intercom devices VTO75X95X, VTO65XXX, and VTH542XH, PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL, Thermal TPC-BF1241, TPC-BF2221, TPC-SD2221, TPC-BF5XXX, TPC-SD8X21, and TPC-PT8X21B devices Buildtime before June, 2021."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/957",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/957"
            },
            {
              "name": "20211005 [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Oct/13"
            },
            {
              "name": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164423/Dahua-Authentication-Bypass.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2021-33044",
    "datePublished": "2021-09-15T21:36:04.000Z",
    "dateReserved": "2021-05-17T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:37:58.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted