Access Control Weakness in Dahua Device Password Reset Process
CVE-2021-33046

9.8CRITICAL

Key Information:

Vendor

Dahuasecurity

Status
Access Control Vulnerability Found In Some Dahua Products
Vendor
CVE Published:
13 January 2022

What is CVE-2021-33046?

Dahua devices exhibit a vulnerability in the password reset process, enabling unauthorized users to exploit specific configurations. This flaw allows attackers to reset passwords, potentially granting them unapproved access to sensitive information and functionalities of the affected devices. Organizations using Dahua products should assess their configurations and ensure proper security measures are in place to mitigate this risk.

Affected Version(s)

Access control vulnerability found in some Dahua products Dahua IP Camera devices IPC-HX3XXX, and IPC-HX5XXX

Access control vulnerability found in some Dahua products PTZ Dome Camera SD1A1, SD22, SD49, SD50, SD52C, and SD6AL

Access control vulnerability found in some Dahua products Thermal TPC-BF1241,TPC-BF2221, TPC-SD2221

References

https://www.dahuasecurity.com/support/cybersecurity/detai...
x_refsource_MISC
https://www.dahuasecurity.com/support/cybersecurity/detai...
x_refsource_CONFIRM
https://support.dahuatech.com/networkSecurity/securityDet...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.