---
title: "Dahua CVE-2021-33044/33045: Camera Login Bypass in KEV"
url: https://erroneo.us/security/briefs/dahua-cve-2021-33044-33045-camera-auth-bypass/
description: "Two 2021 Dahua login bypasses give admin access to unpatched cameras, NVRs and intercoms; a 2026 campaign backdoored 1,923. Update firmware and audit accounts."
type: security-brief
section: "Security Digest"
date_published: 2021-09-01
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-33044", "CVE-2021-33045"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Dahua CVE-2021-33044/33045: Camera Login Bypass in KEV

**Verdict: Check exposure.** Fixed in 2021, but unpatched Dahua devices are still being taken over with public tools in 2026; anyone with Dahua cameras, recorders or intercoms should check firmware dates, exposure and user accounts now.

- **Who must act:** Owners of Dahua IP cameras, NVRs, XVRs, door stations or thermal cameras with firmware built before mid-2021, especially any reachable from the internet or through Dahua P2P.
- **Who can relax:** Organizations with no Dahua video or intercom equipment, and owners whose devices run the 2021 fix firmware or newer, sit behind a firewall and show no unknown accounts.
- **Affected:** CVE-2021-33044: IPC-HX1XXX to HX8XXX and HUM7XXX cameras, VTO75X95X/VTO65XXX door stations, VTH542XH monitors, SD-series PTZ domes and TPC thermal cameras built before June 2021; CVE-2021-33045: the same IPC families built before May 2020; VTO, VTH542XH, NVR1XXX/2XXX/5XXX/6XX and XVR4xxx/5xxx/7xxx devices built before December 2019 (per the CVE record)
- **Fixed:** Per-model fix firmware listed in Dahua DHCC-SA-202106-001 (builds dated June and July 2021), or any newer firmware
- **CVEs:** CVE-2021-33044, CVE-2021-33045
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Dahua cameras, recorders and intercoms and read each build time under Settings > System Information > Version.
2. Update anything built before June 2021 to the fix firmware in DHCC-SA-202106-001 or newer, and replace devices that cannot be updated.
3. Remove internet exposure of TCP 37777 and the web interface, and disable Dahua P2P access unless you need it.
4. List user accounts on every device and delete any you did not create, especially one named p2pwn; a firmware update does not remove it.
5. Change device passwords and any credentials stored on the devices.

### How to check if you are affected

- Look for a user named p2pwn; Hunt.io says it survives password changes and, on most firmware, a factory reset.
- Alert on Dahua login requests containing "clientType": "NetKeyboard", or "loginType": "Loopback" with "ipAddr": "127.0.0.1"; Hunt.io says legitimate clients do not send them.
- Search firewall logs for traffic to 154.86.119.60 or 185.132.53.56, the CameraSwarm operator hosts Hunt.io published.
- Review bursts of failed logins on port 37777 using default credentials such as admin:admin or 888888:888888.

## What happened

On September 1, 2021, Dahua published advisory [DHCC-SA-202106-001](https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202106-001%3Asecurity-advisory---identity-authentication-bypass-vulnerability-found-in-some-dahua-products) and fix firmware for two authentication bypasses in the login process of its cameras, recorders and intercoms. In Dahua's words, attackers "can bypass device identity authentication by constructing malicious data packets." Dahua scores both CVSS 3.1 8.1. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-33044) scores each 9.8. The researcher, bashis, reported them on June 13, 2021, and published full details and a proof-of-concept tool on [Full Disclosure](https://seclists.org/fulldisclosure/2021/Oct/13) on October 6, 2021.

Both bugs abuse the `global.login` call, with no password needed. With [CVE-2021-33044](https://www.cve.org/CVERecord?id=CVE-2021-33044), the client claims to be a "NetKeyboard" controller, and the device skips the password check. It works over Dahua's DHIP protocol and over HTTP. With [CVE-2021-33045](https://www.cve.org/CVERecord?id=CVE-2021-33045), the login request claims to come from the loopback address, which the firmware trusts.

On August 21, 2024, CISA [added both](https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog) to the KEV catalog ([33044](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044), [33045](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045)) "based on evidence of active exploitation," without naming a campaign. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-impacting-dahua-products/) noted it had seen no public reports of malicious use before the warning. The clearest public evidence came later. In August 2026, [Hunt.io](https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised) reconstructed "Operation CameraSwarm" from an operator's exposed working directory. Between June 17 and July 22, 2026, the operator used both bypasses to take over 1,923 cameras. On each one it planted a persistent account named `p2pwn`. It compromised more than 12,000 other devices by guessing passwords on port 37777. Confirmed victims were mostly in Ukraine and Russia. [The Hacker News](https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html) reported the operator as Russian-speaking, with no attribution to a known group.

## Who is affected

CVE-2021-33044 affects many IPC camera families, VTO door stations, VTH monitors, SD-series PTZ domes and TPC thermal cameras built before June 2021. CVE-2021-33045 affects IPC cameras built before May 2020. Per the CVE record, it also hits intercoms and NVR and XVR recorders built before December 2019. Dahua's advisory lists the exact fix firmware per model. The build time is shown under Settings, System Information, Version.

## Do you really need to act?

Only if you own Dahua equipment, but then yes. The fix is five years old, yet the 2026 campaign shows that unpatched units are still being found and taken over. Hunt.io says unpatched firmware is exploitable "in under a second," and proof-of-concept code has been public since 2021. Exposure is not limited to open ports. The operator also reached 283 cameras through Dahua's P2P relay by serial number, including some behind NAT. Patching alone is not enough after a compromise. Hunt.io says the `p2pwn` account survives a password change and, on most firmware, a factory reset. For most software teams with no cameras, this is not a concern.

## What to do now

1. List all Dahua cameras, recorders and intercoms and record each build time.
2. Update anything built before mid-2021 to the advisory's fix firmware or newer. Replace devices that cannot be updated.
3. Keep TCP 37777 and the web interface off the internet, and disable P2P unless you need it.
4. Delete unknown user accounts, especially `p2pwn`, and change all device passwords.

## How to tell if you were hit

- A user named `p2pwn` on any device is a clear sign of compromise.
- Hunt.io says login requests containing `"clientType": "NetKeyboard"`, or `"loginType": "Loopback"` with `"ipAddr": "127.0.0.1"`, do not occur in legitimate traffic. Alert on them.
- Search firewall logs for `154.86.119.60` and `185.132.53.56`, and for bursts of failed logins on port 37777.

## Timeline

- Jun 13, 2021 — bashis contacts Dahua.
- Sep 1, 2021 — Dahua publishes the advisory and fix firmware.
- Oct 6, 2021 — Full disclosure with a proof-of-concept tool.
- Aug 21, 2024 — CISA adds both CVEs to KEV; federal deadline Sep 11, 2024.
- Jun 17, 2026 — Operation CameraSwarm begins; it runs to July 22.
- Aug 18, 2026 — Hunt.io publishes its report.

## Sources

1. [Dahua — DHCC-SA-202106-001: Identity authentication bypass vulnerability found in some Dahua products](https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202106-001%3Asecurity-advisory---identity-authentication-bypass-vulnerability-found-in-some-dahua-products)
2. [bashis (Full Disclosure) — [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045)](https://seclists.org/fulldisclosure/2021/Oct/13)
3. [CVE record — CVE-2021-33044](https://www.cve.org/CVERecord?id=CVE-2021-33044)
4. [CVE record — CVE-2021-33045](https://www.cve.org/CVERecord?id=CVE-2021-33045)
5. [NVD — CVE-2021-33044](https://nvd.nist.gov/vuln/detail/CVE-2021-33044)
6. [NVD — CVE-2021-33045](https://nvd.nist.gov/vuln/detail/CVE-2021-33045)
7. [CISA — Known Exploited Vulnerabilities: CVE-2021-33044](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33044)
8. [CISA — Known Exploited Vulnerabilities: CVE-2021-33045](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33045)
9. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Aug 21, 2024)](https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog)
10. [Hunt.io — Operation CameraSwarm: Dahua cameras compromised](https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised)
11. [The Hacker News — Hackers compromised 14,500 Dahua devices (Aug 19, 2026)](https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html)
12. [SecurityWeek — CISA Warns of Exploited Vulnerabilities Impacting Dahua Products](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-impacting-dahua-products/)

---
Source page: https://erroneo.us/security/briefs/dahua-cve-2021-33044-33045-camera-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt