CVE-2021-33044 is a critical authentication-bypass vulnerability (CWE-287) in the login process of a broad range of Dahua security products — IP cameras, PTZ dome cameras, thermal cameras, video intercoms and NVR/XVR network video recorders built before June 2021 — that lets a remote, unauthenticated attacker construct a malicious data packet using the device's NetKeyboard client type to bypass identity authentication entirely and gain control of the device; NVD has published its own Primary CVSS v3.1 score of 9.8 (critical), and CISA has added the flaw to its Known Exploited Vulnerabilities catalog after confirming it is being actively exploited.
Vulnerability summary
9.8
Critical
100.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2021-09-15
Published
Vulnerability ID: CVE-2021-33044 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Dahua IP cameras (IPC-HX1XXX, HX2XXX, HX3XXX, HX5XXX, HUM7XXX, HX8XXX series), PTZ dome cameras (SD1A1, SD22, SD49, SD50, SD52C, SD6AL), thermal cameras (TPC-BF1241, TPC-BF2221, TPC-BF5XXX, TPC-SD2221, TPC-SD8X21, TPC-PT8X21B), video intercoms (VTO65XXX, VTO75X95X, VTH542XH, DHI-ASI7213Y-V3-T1) and NVR/XVR network video recorders (NVR1XXX, NVR2XXX, NVR5XXX, NVR6XX, XVR4xxx, XVR5xxx, XVR7xxx series) | — | Firmware built before June 2021 for the NetKeyboard login path exploited by CVE-2021-33044 (the companion flaw CVE-2021-33045 covers an earlier loopback 127.0.0.1 login path in firmware built before May 2020 for cameras/intercoms and before December 2019 for recorders); fixed in later firmware per Dahua advisory DHCC-SA-202106-001 |
What does this mean for affected devices?
CVE-2021-33044 (CWE-287, improper authentication) affects the login process of numerous Dahua security products. NVD's description states: "The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets" (NVD).
Dahua's own PSIRT advisory DHCC-SA-202106-001 clarifies the mechanism: the flaw is triggered through the NetKeyboard client type during the authentication handshake, distinct from a companion vulnerability, CVE-2021-33045, which instead abuses a loopback login request to the 127.0.0.1 address — both were credited to researcher Bashis and disclosed together, with limited disclosure on 2021-09-06 and full disclosure on 2021-10-06 (Dahua PSIRT DHCC-SA-202106-001).
NVD lists CVE-2021-33044 with status "Analyzed" and its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching a Secondary submission at the same score; NVD also carries a legacy Primary CVSS v2 score of 10.0 (NVD). Dahua's own vendor advisory, by contrast, rates the same flaw lower — a base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with a temporal score of 7.3 — illustrating a real gap between the vendor's self-assessment and NVD's independently analyzed score for this bug (Dahua PSIRT DHCC-SA-202106-001).
CISA added CVE-2021-33044 (and CVE-2021-33045) to its Known Exploited Vulnerabilities catalog on 2024-08-21, meaning CISA has confirmed evidence of active, in-the-wild exploitation and federal agencies are directed to remediate or discontinue use (CISA KEV catalog — CVE-2021-33044). FIRST's EPSS model scores the probability of exploitation at 0.9999 (99.98th percentile) as of 2026-11-07, among the highest EPSS scores possible, consistent with sustained real-world abuse (FIRST EPSS).
Real-world exploitation has been extensively documented: a joint advisory from CISA, the FBI and international partners attributed exploitation of CVE-2021-33044 and CVE-2021-33045 against internet-facing Dahua cameras to Russian GRU-linked actors tracked as Unit 29155, and a 2026 campaign nicknamed "Operation CameraSwarm" used mass internet scanning on port 37777 to compromise over 14,000 Dahua devices via the same pair of flaws (The Hacker News, August 2026).
Operators of any affected Dahua IP camera, PTZ dome, thermal camera, video intercom or NVR/XVR recorder running pre-patch firmware should apply Dahua's fixed firmware immediately, per DHCC-SA-202106-001, and should not expose these devices' management ports directly to the internet.
Evidence
- The identity authentication bypass vulnerability found in some Dahua products during the login process; attackers can bypass device identity authentication by constructing malicious data packets. — NVD
- CVE-2021-33044 is triggered via the NetKeyboard client type during login, distinct from the loopback (127.0.0.1) path used by companion CVE-2021-33045; both reported by researcher Bashis; Dahua's own base score is 8.1, temporal 7.3. — Dahua PSIRT DHCC-SA-202106-001
- NVD status 'Analyzed'; NVD Primary CVSS v3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; legacy Primary CVSS v2 score 10.0. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-08-21. — CISA KEV catalog — CVE-2021-33044
- FIRST EPSS score 0.9999 (99.98th percentile) as of 2026-11-07. — FIRST EPSS
- Operation CameraSwarm used mass scanning on port 37777 to compromise over 14,000 Dahua devices via CVE-2021-33044 and CVE-2021-33045; the same CVE pair was separately attributed to Russian GRU Unit 29155 against internet-facing Dahua cameras. — The Hacker News
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker do by exploiting CVE-2021-33044?
An attacker who sends a specially crafted login packet using the device's NetKeyboard client type can bypass identity authentication entirely on an affected Dahua IP camera, PTZ dome, thermal camera, video intercom or NVR/XVR recorder, gaining access without valid credentials (per NVD and Dahua PSIRT DHCC-SA-202106-001).
Is CVE-2021-33044 being actively exploited in the wild?
Yes. CISA added CVE-2021-33044 to its Known Exploited Vulnerabilities catalog on 2024-08-21, a joint advisory tied its exploitation to the Russian GRU-linked Unit 29155, and a 2026 mass-scanning campaign called Operation CameraSwarm used it (with companion CVE-2021-33045) to compromise over 14,000 Dahua devices (per CISA KEV and The Hacker News).
Do NVD and Dahua agree on how severe this vulnerability is?
Not exactly — NVD's own Primary CVSS v3.1 score is 9.8 (critical), while Dahua's vendor advisory rates the same flaw at 8.1 base / 7.3 temporal; both treat it as serious, but NVD's independently analyzed score is notably higher (per NVD and Dahua PSIRT DHCC-SA-202106-001).