by Kastro
Paper/Archive/CVE-2021-33046

CVE-2021-33046

dahua — Some Dahua products have access control vulnerability in the password reset process.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.4.704 × 2014.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.

Affected

ProductAffectedFixed inSource
Access control vulnerability found in some Dahua productsDahua IP Camera devices IPC-HX3XXX, and IPC-HX5XXX–CNA
Access control vulnerability found in some Dahua productsPTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL–CNA
Access control vulnerability found in some Dahua productsThermal TPC-BF1241,TPC-BF2221, TPC-SD2221–CNA
Access control vulnerability found in some Dahua productsVTO2101E, VTOX221E, and ASC2204C devices Buildtime between 2017/7 ~ 2021/7. NVR devices NVR4XXX, and NVR5XXX–CNA
Access control vulnerability found in some Dahua productsXVR devices XVR4XXX, and XVR5XXX–CNA
Access control vulnerability found in some Dahua productsHCVR devices HCVR7XXX, and HCVR8XXX devices Buildtime between 2017/1 ~ 2021/7.–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdahuasecurity.com/support/cybersecurity/details/957refdahuasecurity.com/support/cybersecurity/details/987refsupport.dahuatech.com/networkSecurity/securityDetails?id=95