Authentication bypass

1. Summary

Two related pre-authentication flaws in the login handler of Dahua IP cameras, video intercoms, and recorders let a remote, unauthenticated attacker obtain a valid admin-equivalent session by sending a single crafted global.login request. The defect is improper authentication (CWE-287): the device grants a session based on attacker-controlled client-type / login-type fields rather than verifying real credentials or the true network origin. CVE-2021-33044 abuses the NetKeyboard client type; CVE-2021-33045 spoofs a Loopback (127.0.0.1) login. A successful request returns a session token that unlocks full device functionality — live and recorded video/audio, configuration, and device control.

2. Affected products & versions

Two CVEs cover overlapping fleets with different affected-version windows: CVE-2021-33044 (NetKeyboard) affects firmware built before June 2021 [1]; CVE-2021-33045 (Loopback) affects firmware built before May 2020 (IPC lines) or December 2019 (XVR lines) per NVD’s per-line buildtime phrasing [2]. The tables below are split by CVE for readability. Precise per-model fixed builds are enumerated only in Dahua’s advisory (source 5); cells that NVD did not confirm are marked “see Dahua advisory [5]”.

CVE-2021-33044 (NetKeyboard) — firmware buildtime before June 2021 [1]

CVE-2021-33045 (Loopback) — firmware buildtime before May 2020 (IPC) / December 2019 (XVR) [2]

Dahua released approximately 70 firmware updates across the portfolio to remediate both CVEs [8].

3. The vulnerability in detail

Dahua devices — IP cameras, video intercoms, and recorders — expose a JSON-RPC-style login method named global.login. This method is reachable over Dahua’s proprietary binary DHIP protocol (typically TCP/5000, and also TCP/80) and, for the NetKeyboard variant specifically, over plain HTTP (TCP/80) and HTTPS (TCP/443) [3][6]. The vulnerability lives in the server-side authentication and session-granting logic of the embedded device firmware that processes this login request [1][2]. Two distinct but closely related bypass primitives exist, each fully unauthenticated and each abusing a field the client controls in the login payload.

The root cause common to both is improper authentication (CWE-287): the login handler trusts attacker-supplied fields describing what kind of client is connecting, and where it is connecting from, and uses those fields to decide whether to skip credential validation — instead of actually verifying a password or independently establishing the real source address [3]. CWE-287 describes exactly this failure class: the software performs an authentication decision but the decision does not actually prove the claimant’s identity. Here the “proof” the device relies on is a self-asserted client type or a self-asserted loopback origin, both of which the attacker simply writes into the request. The device asks the client to describe itself, believes the description, and hands over an admin session on the strength of that self-description. Neither primitive depends on a memory-corruption or timing quirk — the flaw is purely logical, in which branch of the authentication code the request is routed to, which is why a single well-formed packet is a reliable, repeatable exploit against every unpatched unit in the fleet. NVD’s official description for both CVEs captures the class in one line: attackers “bypass device identity authentication by constructing malicious data packets” [1][2].

CVE-2021-33044 (NetKeyboard). The NetKeyboard client type exists to support Dahua’s network-keyboard control accessories. On older firmware that lacks real NetKeyboard functionality, the login handler nonetheless recognizes the NetKeyboard client type and, when it sees it, grants a session without validating the supplied password [3]. The attacker sends a global.login request with userName=admin, loginType=Direct, clientType=NetKeyboard, authorityType=Default, passwordType=Default, and a placeholder password literally set to "Not Used" [3]. Because the handler never checks the credential when the client claims to be a NetKeyboard, it responds with {"result":true,"session":<sessionID>} and a keepAliveInterval of 60 seconds [3]. The attacker now holds a valid admin-equivalent session. The load-bearing mistake is that the clientType string is treated as a capability grant rather than a mere descriptor: the branch meant to accommodate a legitimate keyboard accessory (which authenticates by other means) is entered on the strength of the attacker’s own claim, and no server-side check confirms the client is actually a provisioned NetKeyboard.

CVE-2021-33045 (Loopback). The companion primitive spoofs a local/loopback login. The device special-cases requests that appear to originate from 127.0.0.1 as trusted local logins and relaxes network authentication for them — but it derives “is this loopback?” from an attacker-supplied field rather than from the actual TCP source address [3]. The attacker sends global.login with userName=admin, ipAddr=127.0.0.1, loginType=Loopback, clientType=Local, authorityType=Default, and a password field (accepted as either an MD5 hash or, with passwordType=Plain, plaintext) [3]. The handler treats the request as locally-originated, bypasses the normal network authentication path, and returns a valid session [3]. The load-bearing mistake here is symmetrical to the NetKeyboard case: the device trusts the self-reported ipAddr / loginType=Loopback rather than comparing against the real peer address of the TCP connection it accepted, so a remote attacker asserting “I am 127.0.0.1” is treated as if physically local to the device. A notable protocol constraint: the Loopback bypass works only over DHIP (TCP/5000 or 80), not over TLS on 443, whereas the NetKeyboard bypass works over DHIP, HTTP, and HTTPS [6].

Why two windows. The differing affected-version windows follow directly from the two mechanisms. NetKeyboard (33044) depends on firmware that recognizes the NetKeyboard client type but lacks genuine NetKeyboard support — a condition that persisted until the June 2021 fixes, giving the broader “buildtime before June 2021” window [1]. Loopback (33045) was addressed earlier in the firmware lifecycle for most lines, which is why NVD pins it to “buildtime before May 2020” for the IPC lines and “buildtime before December 2019” for the XVR lines [2]; the earlier remediation is why the 33045 window is narrower than 33044’s.

Exploitation chain. (1) The attacker reaches an exposed device on DHIP (5000 or 80), or HTTP/HTTPS (80/443) for NetKeyboard, with no credentials [3]. (2) The attacker crafts a single global.login JSON request with the appropriate spoofed fields for the chosen variant [3]. (3) The vulnerable login handler grants the request based on the crafted client/login-type fields rather than verifying credentials or the real source IP [3]. (4) The device responds {"result":true,"session":<sessionID>} with a 60-second keep-alive, returning an admin-equivalent session token [3]. (5) The attacker uses that session — e.g. via the public mcw0/DahuaConsole tool — to reach device functions: live and recorded video/audio, full configuration, and device control [6]. The two variants are interchangeable at step (2): an attacker who finds DHIP open but no HTTP can still use either primitive; one who finds only HTTP/HTTPS must use NetKeyboard, since Loopback is DHIP-only [6].

Preconditions. The attack is remote and fully unauthenticated: no credentials, no physical or RF adjacency. The only precondition is network reachability to the device’s DHIP port (5000 or 80) or, for NetKeyboard, HTTP/HTTPS (80/443) [3][6]. The NetKeyboard bypass specifically depends on older devices that lack genuine NetKeyboard support, which is why the affected-version window is firmware buildtime before June 2021 for 33044 and buildtime before May 2020 (IPC) / December 2019 (XVR) for 33045 [1][2].

Proof-of-concept status. PoC tooling has been public since 2021. The researcher’s mcw0/DahuaConsole implements both the netkeyboard logon (33044, over DHIP/HTTP/HTTPS) and the loopback logon (33045, over DHIP) as command-line options, with a detailed writeup in mcw0/PoC [6]. Both CVEs are now KEV-listed, indicating exploitation is known or expected [8].

4. Discovery & timeline

Both vulnerabilities were discovered and disclosed by independent researcher “bashis” (mcw0), via the Full Disclosure mailing list and coordinated with Dahua’s PSIRT [3][4]. The coordination phase ran roughly June 13 – July 5, 2021 [4]. An initial limited disclosure was posted on September 6, 2021, announcing a 30-day embargo [3][4], followed by full technical disclosure on October 6, 2021 [3]. Dahua released remediating firmware — approximately 70 builds across the product portfolio — in 2021 [8]. Nearly three years later, CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 21–22, 2024, with a federal remediation deadline of September 11, 2024 [7][8].

5. Technical reference

• CVEs: CVE-2021-33044 (NetKeyboard bypass) [1]; CVE-2021-33045 (Loopback bypass) [2].
• CWE: CWE-287 (Improper Authentication) for both, per NVD [1][2].
• CVSS 3.1: Both scored base 9.8 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1][2]. What the metrics mean here: AV:N — reachable over the network; AC:L — a single crafted packet, no special conditions; PR:N / UI:N — no credentials and no victim interaction; S:U — impact stays within the device’s own scope; C:H/I:H/A:H — full compromise of confidentiality (video/audio/config), integrity (config/device control), and availability (attacker controls the device).
• KEV: Both listed in CISA KEV, added Aug 21–22, 2024 [7][8].
• Code/commit refs: No firmware source/binary function reference is public. PoC: mcw0/DahuaConsole and the mcw0/PoC writeup (Dahua authentication bypass.txt) [6]. Vendor advisory: dahuasecurity.com/support/cybersecurity/details/957 [5].

6. Consequence & CFSE path analysis

Real-world consequence: a remote attacker with no credentials who can reach one of these devices gains a full admin session. On camera and recorder models that means watching and exfiltrating live and recorded video and audio, and reconfiguring or disabling the device. On VTO door-station/intercom models, that same admin authority reaches the device’s control functions — including, by the product line’s purpose, door-release and the ability to disable monitoring — turning a surveillance-privacy problem into a physical-security and safety problem. Because the bypass is a single reusable packet against a homogeneous fleet, it is mass-scannable and applies uniformly across exposed devices.

CVSS scores this as a flat 9.8 for both CVEs — a single “critical confidentiality/integrity/availability” verdict. The CFSE path analysis decomposes the same bypass into three consequence paths and, on two of them, lands higher than the CVSS framing implies (direction: UNDER relative to the published 9.8 baseline), because CVSS does not distinguish “attacker can read the camera” from “attacker can open the door.” (The claim that CFSE exceeds the 9.8 CRITICAL baseline rests, for the safety path specifically, on the door-release inference discussed below; the authority path exceeds it independently of that inference.)

CFSE bands and verdict:

• DEVICE_CONTROL_SAFETY — EMERGENCY (co-dominant). On VTO door-station/intercom models, admin takeover can drive door-release and disable monitoring, giving a physical-security/safety consequence. Base CRITICAL, uplifted for fleet-reachable authority. This band is load-bearing on an inference. The door-release actuation is product-line-inferred from VTO door-stations’ function, not separately field-demonstrated; available sources document generic admin takeover, video/audio access, and device control, but no door-open PoC. The EMERGENCY verdict for this specific path is therefore only as strong as that inference — if door-release cannot be driven from the admin session on a given model, this path degrades toward the ACCOUNT_AUTHORITY / PERCEPTION_PRIVACY framing and the safety-specific EMERGENCY does not independently hold.
• ACCOUNT_AUTHORITY — EMERGENCY (co-dominant). A single crafted login packet using the NetKeyboard type argument yields admin-equivalent access, reusable fleet-wide and mass-scanned, field-confirmed and CISA-KEV listed, requiring coordinated firmware/credential/config recovery. Base CRITICAL, uplifted. Unlike the safety path, this band does not depend on the door-release inference — it rests on the field-confirmed, KEV-listed admin-session grant, so it stands independently.
• PERCEPTION_PRIVACY — CRITICAL (supporting). The same bypass exposes live/recorded camera and audio feeds — a surveillance/privacy harm, capped as privacy-only with no direct physical actuation.

Overall path_verdict: EMERGENCY, driven by the two co-dominant safety and authority paths, direction UNDER the CVSS 9.8 baseline. Note on robustness: even if the DEVICE_CONTROL_SAFETY path is discounted for lack of a field-demonstrated door-open, the independently-standing ACCOUNT_AUTHORITY EMERGENCY band keeps the overall verdict at EMERGENCY.

7. Remediation & mitigations

• Apply Dahua firmware updates. Upgrade every affected IPC/VTO/VTH/NVR/XVR/PTZ/thermal model to a fixed build (the ~70 firmware updates Dahua released in 2021) [5][8]. NVD confirms fixed builds at/after 2.800.0000000.29.r.210630 (IPC-HX3XXX), 2.820.0000000.5.r.210705 (IPC-HX5XXX/HUM7XXX), and 4.001.0000005.1.r.210709 (NVR-1XXX) [2]; the complete per-model fixed-build list is in Dahua’s advisory (source 5) [5].
• Remove devices from direct Internet exposure. These are unauthenticated, mass-scannable primitives; devices should not have DHIP/HTTP/HTTPS reachable from the Internet.
• Restrict protocol access. Segment and firewall DHIP (TCP/5000 and 80) and HTTP/HTTPS (80/443) behind ACLs or a VPN so only trusted management hosts can reach the login surface [3][6]. Because the Loopback primitive is DHIP-only, restricting TCP/5000 (and DHIP on 80) closes CVE-2021-33045 specifically; NetKeyboard additionally requires restricting HTTP/HTTPS (80/443) [6].
• Rotate admin credentials after patching. Because a valid admin session could have been minted without any password (NetKeyboard needs only the "Not Used" placeholder; Loopback bypasses the network auth path entirely), treat existing credentials as potentially exposed and rotate them once firmware is updated.
• Prioritize VTO door-station/intercom units. Given the physical-security consequence on door-release models, patch and segment intercom/door-station devices ahead of camera-only units where triage is required.
• Federal obligation. CISA required remediation of both CVEs by September 11, 2024 under the KEV catalog [7].

8. Sources

[1] NVD — CVE-2021-33044 Detail — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2021-33044 — Authoritative record for the NetKeyboard bypass: official description (“bypass device identity authentication by constructing malicious data packets”), CVSS 9.8 vector, affected model lines (IPC/VTO/VTH/PTZ/thermal, buildtime before June 2021), CWE-287. — primary-advisory. [2] NVD — CVE-2021-33045 Detail — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2021-33045 — Authoritative record for the Loopback bypass; CVSS 9.8, second distinct primitive, per-line buildtime windows (IPC before May 2020; XVR before December 2019) and fixed builds (e.g. 2.800.0000000.29.r.210630, 2.820.0000000.5.r.210705, 4.001.0000005.1.r.210709). — primary-advisory. [3] [FD] [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045) — Full Disclosure (seclists.org) — https://seclists.org/fulldisclosure/2021/Oct/13 — Researcher disclosure; the unique source explaining both exact mechanisms, request params, response format, protocols, and affected devices. — researcher-primary. [4] Full Disclosure: Dahua CVE-2021-33044, CVE-2021-33045 (initial disclosure) — Full Disclosure (seclists.org) — https://seclists.org/fulldisclosure/2021/Sep/15 — Initial limited disclosure; establishes provenance and the coordinated-disclosure timeline. — researcher-primary. [5] Dahua official security advisory (cybersecurity details 957) — Dahua Technology (PSIRT) — https://www.dahuasecurity.com/support/cybersecurity/details/957 — Vendor advisory acknowledging both CVEs; authoritative source for affected-product scope and ~70 firmware updates. — primary-advisory. [6] mcw0/DahuaConsole — PoC exploitation tool — GitHub (bashis / mcw0) — https://github.com/mcw0/DahuaConsole — Public PoC; implements netkeyboard (DHIP/HTTP/HTTPS) and loopback (DHIP only) logons, confirming exploitability; links the detailed writeup. — community-poc. [7] CISA Known Exploited Vulnerabilities Catalog (CVE-2021-33044) — CISA — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044 — Confirms KEV listing (added Aug 21–22, 2024; remediation due Sep 11, 2024). Corroborated by source 8. — primary-advisory. [8] CISA Warns of Exploited Vulnerabilities Impacting Dahua Products — SecurityWeek — https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-impacting-dahua-products/ — Reputable-press corroboration of the KEV addition, product impact, ~70 firmware updates, and PoC-public-since-2021 / no-confirmed-ITW note. — reputable-press.