What is the CVSS score of CVE-2021-33044?

CVE-2021-33044 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 99.9%.

Is there a public PoC exploit available for CVE-2021-33044?

Yes, a public proof-of-concept exploit is available for CVE-2021-33044. Prioritise patching immediately. EPSS: 99.9%.

Ipc Hum7Xxx Firmware CVE-2021-33044

CRITICAL

Improper Authentication (CWE-287)

2021-09-15 cybersecurity@dahuatech.com

Dahua Authentication Bypass Ipc Hum7Xxx Firmware Ipc Hx3Xxx Firmware Ipc Hx5Xxx Firmware Sd1A1 Firmware Sd22 Firmware Sd49 Firmware Sd50 Firmware Sd52C Firmware Sd6Al Firmware Tpc Bf1241 Firmware Tpc Bf2221 Firmware Tpc Bf5X01 Firmware Tpc Pt8X21B Firmware Tpc Sd2221 Firmware Tpc Sd8X21 Firmware Vto 65Xxx Firmware Vto 75X95X Firmware Vth 542Xh Firmware Tpc Bf5X21 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Sep 15, 2021 - 22:15 nvd

CRITICAL 9.8

DescriptionNVD

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

AnalysisAI

The identity authentication bypass vulnerability found in some Dahua products during the login process. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. Affected products include: Dahuasecurity Ipc-Hum7Xxx Firmware, Dahuasecurity Ipc-Hx3Xxx Firmware, Dahuasecurity Ipc-Hx5Xxx Firmware, Dahuasecurity Sd1A1 Firmware, Dahuasecurity Sd22 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.