CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.

• CWE-287

• https://github.com/Snawoot/hisilicon-dvr-telnetThird Party Advisory
• https://github.com/tothi/hs-dvr-telnetThird Party Advisory
• https://habr.com/en/post/486856/Exploit, Third Party Advisory
• https://www.xiongmaitech.com/en/index.php/news/info/12/68Vendor Advisory
• https://github.com/Snawoot/hisilicon-dvr-telnetThird Party Advisory
• https://github.com/tothi/hs-dvr-telnetThird Party Advisory
• https://habr.com/en/post/486856/Exploit, Third Party Advisory
• https://www.xiongmaitech.com/en/index.php/news/info/12/68Vendor Advisory

Published

Jun 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41499Buffer Overflow Vulnerability exists in ajaxsoundstudio.com …7.5
• CVE-2021-4150A use-after-free flaw was found in the add_partition in bloc…5.5
• CVE-2021-41500Incomplete string comparison vulnerability exits in cvxopt.o…7.5
• CVE-2021-41502An issue was discovered in Subrion CMS v4.2.1 There is a sto…5.4
• CVE-2021-41503DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by…8
• CVE-2021-41504An Elevated Privileges issue exists in D-Link DCS-5000L v1.0…8
• CVE-2021-41511The username and password field of login in Lodging Reservat…9.8
• CVE-2021-41524While fuzzing the 2.4.49 httpd, a new null pointer dereferen…7.5
• CVE-2021-41525An issue related to modification of otherwise restricted fil…5.5
• CVE-2021-41526A vulnerability has been reported in the windows installer (…7.8
• CVE-2021-41527An error related to the 2-factor authorization (2FA) on the …2.3
• CVE-2021-41528An error when handling authorization related to the import /…5.3