erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: September 1, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Dahua CVE-2021-33044/33045: Camera Login Bypass in KEV. Owners of Dahua IP cameras, NVRs, XVRs, door stations or thermal cameras with firmware built before mid-2021, especially any reachable from the internet or through Dahua P2P.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-33044, CVE-2021-33045

Dahua CVE-2021-33044/33045: Camera Login Bypass in KEV

Fixed in 2021, but unpatched Dahua devices are still being taken over with public tools in 2026; anyone with Dahua cameras, recorders or intercoms should check firmware dates, exposure and user accounts now.

Must act: Owners of Dahua IP cameras, NVRs, XVRs, door stations or thermal cameras with firmware built before mid-2021, especially any reachable from the internet or through Dahua P2P.

Can relax: Organizations with no Dahua video or intercom equipment, and owners whose devices run the 2021 fix firmware or newer, sit behind a firewall and show no unknown accounts.

  1. Inventory Dahua cameras, recorders and intercoms and read each build time under Settings > System Information > Version.
  2. Update anything built before June 2021 to the fix firmware in DHCC-SA-202106-001 or newer, and replace devices that cannot be updated.
  3. Remove internet exposure of TCP 37777 and the web interface, and disable Dahua P2P access unless you need it.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.