CVE-2021-33045 Dahua Loopback Auth Bypass via Spoofed 127.0.0.1

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

This rule detects exploitation attempts against CVE-2021-33045 in Dahua devices. It identifies network traffic where a 'global.login' RPC request uses the 'Loopback' login type with a spoofed source IP address of '127.0.0.1' within the request body, while the actual TCP source address of the packet originates from a remote/external location. This technique is used to bypass authentication mechanisms.