Is CVE-2021-33045 (Dahua IP Camera Authentication Bypass) being exploited in the wild?

Yes. CISA added CVE-2021-33045 to its Known Exploited Vulnerabilities catalogue on 21 August 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

What the Exploit Means for Exposure

This is not a theoretical flaw. A CISA KEV listing means defenders should treat the issue as actively abused, not merely disclosed. For Dahua IP cameras and related products, the practical question is whether any exposed device still allows authentication to be bypassed when loopback is specified by the client, especially on internet-reachable or lightly segmented camera networks.

For practitioners, the first task is inventory and scoping: identify every Dahua camera and downstream system that trusts camera authentication state, especially VMS, remote admin interfaces and integrations that reuse the same trust path. The IoT Security Guide is useful here because camera security is not just a device problem, it is also a segmentation and lifecycle problem.

How to Respond When You Cannot Patch Immediately

If patching must wait, reduce the reachable attack surface around the camera rather than relying on the device to resist abuse. Put the cameras behind tight network controls, restrict administrative access to known management hosts, and remove any direct internet exposure. Because authentication is the failure point, you should also review whether any management plane, recorder or cloud bridge can be reached with the same trust assumptions.

Where remote access is unavoidable, prefer compensating controls that force traffic through monitored, authenticated paths and that make unusual access visible. Guidance on zero-day and actively exploited flaws is relevant because the operational response is the same pattern: prioritise containment, emergency mitigation and post-change verification before normal remediation cycles resume.

What to Check After Remediation

Do not stop at “patched.” Validate that the vulnerable device is no longer reachable through the same access path, and look for signs that the camera or its surrounding infrastructure was used before containment. On camera and IoT estates, that means checking configuration drift, unexpected admin activity, unfamiliar source IPs, log gaps and any downstream systems that may have accepted illegitimate sessions or commands.

Because CISA has already placed this CVE in KEV, the safest assumption is that adversaries had time to scan for it and attempt exploitation. Use the vendor advisory and the CISA KEV catalogue for exact version and mitigation details, then verify remediation by test, not by assumption. If camera credentials, management sessions or adjacent administrative accounts were exposed, rotate them as part of the closure step.

Risk and Threat Considerations

Authentication bypass in a network camera matters because cameras often sit on trusted internal segments while still being reachable from management tools, remote support paths or cloud-connected monitoring. That creates a high-value foothold for reconnaissance, lateral movement or stealthy persistence if the device is abused before it is patched.

Failure mechanism: The device accepts a client-controlled authentication condition that should not confer access, so an attacker can enter or control the camera without possessing valid credentials.

Impact: An attacker can potentially alter camera settings, monitor video, use the device as an internal pivot point, or abuse the camera as a durable foothold inside a segmented environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-12 — Network Infrastructure Management	Camera exposure is reduced by network segmentation and restricting management paths.
	CIS-7 — Continuous Vulnerability Management	The question is about an actively exploited CVE and requires prioritised remediation.
Recommendation — Segment camera networks and restrict management access to approved hosts. Prioritise KEV-listed devices for immediate remediation and verification.
NIST SP 800-53 Rev 5	CM-8 — System Component Inventory	You must know where Dahua devices exist before you can contain or patch them.
	SC-7 — Boundary Protection	Containment depends on limiting direct reachability of the vulnerable camera path.
Recommendation — Maintain an accurate inventory of all camera assets and their exposure state. Enforce boundary restrictions around camera management and remote access paths.
OWASP API Security Top 10	API2 — Broken Authentication	The vulnerability is an authentication bypass, which maps directly to broken authentication risk.
Recommendation — Review authentication assumptions and block any unauthenticated access path to the device.

Practitioner Guidance

What to prioritise: Treat every exposed instance as a containment exercise first and a patch task second. Internet exposure, shared admin paths and reused credentials increase the chance that the flaw has already been probed or chained with other access paths.

What to verify: Confirm the exact product family, confirm whether the vulnerable access path is still reachable, and confirm whether any downstream monitoring or recording system trusts the camera too broadly. If you cannot prove those three points, assume the estate still has exposure.

Practitioner takeaway: For exploited camera flaws, the real control is not just applying a fix, it is proving that the device no longer offers an attacker a trusted path into the rest of the environment.