VulnSocial

CVE-2021-33045Active Exploitation(dahuasecurity / ipc-hum7xxx)

MEDIUMCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for dahuasecurity ipc-hum7xxx systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

dahuasecurity CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-09-11. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-287

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ipc-hum7xxx
  • ipc-hum7xxx_firmware
  • ipc-hx3xxx
  • ipc-hx3xxx_firmware

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
dahuasecurity
Products
ipc-hum7xxxipc-hum7xxx_firmwareipc-hx3xxxipc-hx3xxx_firmwareipc-hx5xxxipc-hx5xxx_firmwarenvr-1xxxnvr-1xxx_firmwarenvr-2xxxnvr-2xxx_firmware

1 version affected across 36 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-19: 1Active Exploitation · 2026-08-19: 108-19
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Cybersecurity News Everyday@TweetThreatNews
    Active Exploitation

    CameraSwarm compromised 14,500+ Dahua IP cameras in a 35-day campaign, mainly in Ukraine and Russia, using brute force, CVE-2021-33044, CVE-2021-33045, and offline recovery codes. #Ukraine #Dahua #CameraSwarm https://www.hendryadrian.com/hackers-compromise-14500-dahua-web-cameras-in-35-day-campaign/ https://t.co/FAZBcgvMWy

    Post summary

    The text reports real‑world exploitation of CVE‑2021‑33044 and CVE‑2021‑33045 against more than 14,500 Dahua cameras across Ukraine and Russia during a 35‑day campaign.

    00000235
    4.6K followersView on X
CPE platform detail37 entries

37 of 37 entries

PartVendorProductVersionTarget SWTarget HW
HWdahuasecurityipc-hum7xxx---
OSdahuasecurityipc-hum7xxx_firmware---
HWdahuasecurityipc-hx3xxx---
OSdahuasecurityipc-hx3xxx_firmware---
HWdahuasecurityipc-hx5xxx---
OSdahuasecurityipc-hx5xxx_firmware---
HWdahuasecuritynvr-1xxx---
OSdahuasecuritynvr-1xxx_firmware---
HWdahuasecuritynvr-2xxx---
OSdahuasecuritynvr-2xxx_firmware---
HWdahuasecuritynvr-4xxx---
OSdahuasecuritynvr-4xxx_firmware---
HWdahuasecuritynvr-5xxx---
OSdahuasecuritynvr-5xxx_firmware---
HWdahuasecuritynvr-6xx---
OSdahuasecuritynvr-6xx_firmware---
HWdahuasecurityvth-542xh---
OSdahuasecurityvth-542xh_firmware---
HWdahuasecurityvto-65xxx---
OSdahuasecurityvto-65xxx_firmware---
HWdahuasecurityvto-75x95x---
OSdahuasecurityvto-75x95x_firmware---
HWdahuasecurityxvr-4x04---
OSdahuasecurityxvr-4x04_firmware---
OSdahuasecurityxvr-4x04_firmware---
HWdahuasecurityxvr-4x08---
OSdahuasecurityxvr-4x08_firmware---
HWdahuasecurityxvr-5x04---
OSdahuasecurityxvr-5x04_firmware---
HWdahuasecurityxvr-5x08---
OSdahuasecurityxvr-5x08_firmware---
HWdahuasecurityxvr-5x16---
OSdahuasecurityxvr-5x16_firmware---
HWdahuasecurityxvr-7x16---
OSdahuasecurityxvr-7x16_firmware---
HWdahuasecurityxvr-7x32---
OSdahuasecurityxvr-7x32_firmware---

Explore more

Back to dashboarddahuasecurity CVEsipc-hum7xxx vulnerabilities