CVE-2021-33045

This flaw is like a door lock that can be tricked—attackers send a special kind of network message during login, and the camera/recorder accepts them as if they were an authorized user. That means someone may be able to watch, control, and potentially keep access through hidden accounts.

This matters if your business uses Dahua cameras/recorders/access control systems running affected firmware in the listed families (ipc-hum7xxx, ipc-hx3xxx, ipc-hx5xxx, nvr-1xxx, nvr-2xxx, nvr-4xxx, nvr-5xxx, nvr-6xx, vth-542xh, vto-65xxx).
It is only a risk when the affected device is reachable over the network (and can be reached by an attacker), and no authentication is needed to attempt the bypass—so a publicly exposed or otherwise reachable device is especially concerning.

Attackers are already using this flaw in real incidents, and CISA has included it in its Known Exploited Vulnerabilities list. Because it allows remote, password-free access on reachable devices, you should treat this as a stop-what-you-are-doing and patch immediately item for any affected Dahua hardware.