CVE-2021-33046

Some Dahua products have access control vulnerability in the password reset process

published January 13, 2022

CVSS
—
EPSS
1%
Percentile
70.1
In the wild
Unconfirmed
What it is

⚠️ A gap in the password reset process could let attackers take over Dahua devices with just a few clever steps! 🔑 Think of it like a hotel that resets room keys without verifying guest identities — anyone could waltz in and swipe the keys, bypassing security entirely! If exploited, an attacker could easily reset the passwords for Dahua devices, gaining unauthorized access and control. This could lead to surveillance cameras being manipulated or sensitive data being exposed, impacting security and privacy in ways that could be absolutely devastating!

Put simply

Think of it like a hotel that resets room keys without verifying guest identities — anyone could waltz in and swipe the keys, bypassing security entirely! This vulnerability allows unauthorized password resets in certain Dahua products, letting attackers gain control over the device without proper authentication checks during the reset process.

What to do

If exploited, an attacker could easily reset the passwords for Dahua devices, gaining unauthorized access and control. This could lead to surveillance cameras being manipulated or sensitive data being exposed, impacting security and privacy in ways that could be absolutely devastating! To protect against this vulnerability, ensure all Dahua devices are updated to their latest firmware where possible. Educate users about strong, unique passwords that aren’t easily guessable, and consider implementing additional security measures like two-factor authentication if available. You’ve got this! Implement these steps to secure your devices and keep your network safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01296 · 70.1th percentile
Published
2022-01-13T20:27Z
EPSS history
Timeline
  • 13 JAN 20:27Z
    Some Dahua products have access control vulnerability in the password reset process
    cvelistv5