CVE-2021-33045
CRITICAL KEV NUCLEIDahua Multiple Devices Firmware - Authentication Bypass via Malicious Data Packet
Title source: llmExploitation Summary
CVE-2021-33045 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 21, 2024. EIP tracks 3 public exploits from researchers including dongpohezui, lequoca. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional MITM proxy script that exploits CVE-2021-33045, an authentication bypass vulnerability in Dahua cameras. The script intercepts and modifies HTTP requests to the `/RPC2_Login` endpoint, injecting a crafted session to bypass authentication.
Description
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Exploits (3)
This repository contains a functional MITM proxy script that exploits CVE-2021-33045, an authentication bypass vulnerability in Dahua cameras. The script intercepts and modifies HTTP requests to the `/RPC2_Login` endpoint, injecting a crafted session to bypass authentication.
The repository contains a functional Python script that exploits CVE-2021-33045, an authentication bypass vulnerability in Dahua IP cameras. The script sends crafted HTTP requests with spoofed cookies to access sensitive configuration endpoints without valid authentication.
This repository contains functional exploit code for bypassing authentication in Dahua cameras by overriding jQuery.extend to manipulate login parameters. It includes multiple methods targeting CVE-2021-33044 and CVE-2021-33045.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H