Authentication Bypass (CVE‑2021‑33045) in Dahua IP Camera Firmware Threatens Physical Security
What It Is – A flaw in Dahua IP‑camera firmware allows an attacker to bypass authentication by specifying the loopback device during the login handshake. The vulnerability is tracked as CVE‑2021‑33045 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability – The bypass can be triggered remotely without valid credentials. Public proof‑of‑concept code exists, and the CVSS v3.1 base score is 9.8 (Critical).
Affected Products – All Dahua IP cameras and related video‑surveillance appliances that run the vulnerable firmware version (specific versions disclosed in the vendor advisory).
Why It Matters for Trust & Control Assurance
- Access‑control integrity – The flaw directly violates the control objective of enforcing strong authentication before granting device access, a requirement across SOC 2, ISO 27001, NIST CSF and many sector‑specific standards.
- Continuous evidence – Demonstrating that firmware is up‑to‑date and that authentication logs are collected provides defensible audit evidence of due diligence.
- Enterprise‑buyer expectations – Buyers now request proof that IoT endpoints are protected by documented patch‑management processes and that any deviation is continuously monitored.
Recommended Actions
- Inventory all Dahua cameras and verify firmware versions.
- Apply the vendor‑released patch or upgrade to a non‑vulnerable firmware release immediately.
- Segment camera networks from core IT systems and enforce strict firewall rules.
- Enable logging of authentication attempts and integrate logs into a SIEM for continuous monitoring.
- Document the remediation steps in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2021‑33045