CVE-2021-33044

This vulnerability is like a camera’s front door that can be tricked into thinking the visitor is authorized, even when they don’t have valid login credentials. Attackers send special network messages that make the device skip its identity check, letting them take control as if they logged in legitimately. In recent activity, attackers have used similar techniques to install long-lasting “backdoor” access on cameras.

This matters if you use or manage certain Dahua IP camera and recorder firmware families: ipc-hum7xxx, ipc-hx3xxx, ipc-hx5xxx, sd1a1, sd22, sd49, sd50, sd52c, sd6al, or tpc-bf1241.

It is most risky when the device is reachable on the network (and particularly if it is reachable from the internet) because the flaw requires no login and no user action; an attacker only needs network reachability to the vulnerable device using crafted packets.

This is a RED issue because attackers are actively exploiting it in the real world, and it has been confirmed in CISA’s Known Exploited Vulnerabilities list. Automated, internet-based attempts are plausible because exploitation does not require credentials or user interaction. You should treat reachable vulnerable devices as currently at risk and prioritize patching and network lockdown immediately.