Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.
Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.
- Operation CameraSwarm compromised 14,530+ Dahua cameras across three attack vectors
- CVE-2021-33044 and CVE-2021-33045 auth bypasses used on 1,923 cameras with persistent account deployment
- P2P relay via Easy4IP allowed 283 devices behind NAT to be reached without authentication
- Operator tooling recovered from 407 MB exposed directory; activity attributed only to Russian-speaking actor
- Both 2021 CVEs remain in CISA KEV; users urged to update firmware, disable P2P, and use strong credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33044 +1 in the same advisory: …33045 | Authentication Bypass in Dahua IP Camera Firmware Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known. Do: Apply the mitigations or patched firmware specified in Dahua's security advisory for CVE-2021-33044; if mitigations are unavailable, discontinue use of the product as CISA's required action directs. Inventory internet-facing Dahua cameras and related devices, restrict their login interfaces from direct internet exposure, and review authentication logs for signs of prior exploitation. Ransomware use is listed as unknown, so treat any compromised camera as a potential network foothold and rotate any credentials used on the device. | 9.8 | 100% | KEV PoC ×2 |
| massplausibly millions of installed Dahua cameras worldwide, with likely >100,000 internet-exposed Dahua devices | |
| CVE-2024-39943 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload per rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js). NVD description · AI analysis pending | 8.8 | 37% |
| — | ||
| CVE-2025-31702 | A vulnerability exists in certain Dahua embedded products. A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected. NVD description · AI analysis pending | 6.8 | <1% | — | — |
Full article958 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique.
The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including tooling, logs, shell history, and campaign records, with the researchers saying confirmed compromises were concentrated in Ukraine and Russia.
The researchers said 1,923 cameras were configured with a persistent account during the operation and 283 were reached through the P2P path.
Users of affected Dahua products are advised to install the corresponding fix software or newer firmware, while ITRES Labs recommends disabling P2P where it is not required and checking firmware against the vendor's download site.
"The relay establishes the route without prior authentication, leaving login checks to the device's web application," ITRES Labs said in an analysis published in October 2025.
Hunt.io attributed the 14,530-plus total to three attack paths -
- Credential attacks: 12,324 unique IP addresses across 13,229 campaign records.
- Authentication bypass: 1,923 cameras reached using CVE-2021-33044 and CVE-2021-33045, which Hunt.io said were also configured with the persistent account.
- P2P relay: 283 cameras identified by serial number, including devices located behind network address translation (NAT).
The two 2021 flaws are authentication-bypass vulnerabilities in Dahua cameras and related products. Dahua's advisory rates them 8.1 on the CVSS scoring system and lists fixed firmware, while the U.S. National Vulnerability Database (NVD) currently assigns each a CVSS score of 9.8.
"Attackers can bypass device identity authentication by constructing malicious data packets," Dahua said in its advisory.
A NetKeyboard client type triggers CVE-2021-33044 during authentication, while CVE-2021-33045 involves a loopback login request using the 127.0.0.1 address, according to the original disclosure from security researcher Bashis.
As of August 19, 2026, both flaws remain listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, which records them as Dahua IP camera authentication-bypass vulnerabilities and advises applying vendor mitigations or discontinuing use if mitigations are unavailable.
As of August 19, 2026, the public p2pwn repository remains accessible and independently confirms that the tool accepts Dahua serial numbers as input, checks CVE-2021-33044 and CVE-2021-33045, and contains a default dummy-account configuration.
The repository does not establish Hunt.io's count of 1,923 affected cameras or its claim that the account survives a factory reset on most firmware. The P2P path is separate from the two authentication-bypass flaws.
ITRES Labs found during an earlier incident response investigation that, on firmware before mid-2024, a valid Dahua serial number could be used to establish an Easy4IP relay path before the connected device performed its own credential check, allowing a device behind NAT to become reachable through the vendor's relay infrastructure.
The dh-p2p proof-of-concept repository also shows that the Dahua P2P protocol locates a device through Easy4IPCloud using its serial number and can establish a tunnel to the camera or network video recorder.
A successful P2P relay can make the device reachable behind NAT, but device-level authentication can still be required for access.
Hunt.io said the operator's recovered code recorded 89.4% of live serial numbers returning an open channel without authentication.
That figure remains a campaign-specific claim from the recovered operator material. It has not been independently reproduced by ITRES Labs, Dahua, or a public computer emergency response team advisory located as of August 19, 2026.
Two CVE labels associated with the recovered tooling do not describe the P2P behavior: CVE-2024-39943 is assigned by NVD to an operating-system command-injection flaw in Rejetto HFS, while Dahua describes CVE-2025-31702 as a privilege-escalation flaw that requires previously obtained normal-user credentials.
ITRES Labs described the serial-number relay exposure as a non-CVE issue and said its testing found that the P2P path was reinforced in firmware released after mid-2024.
The firm advised defenders to disable P2P unless required, restrict Easy4IP connectivity where appropriate, update devices using firmware from the vendor's website, use strong unique credentials, remove unused accounts, and segment video surveillance systems.
Dahua's advisory directs customers to install the listed repair software or newer firmware. In a statement shared with The Hacker News, Dahua said, "The Hunt.io report reflects the findings of its independent research. According to the report, the attack methods primarily involve password cracking and exploitation of vulnerabilities CVE-2021-33044 and CVE-2021-33045, which Dahua had already disclosed on its official website in 2021."
"Dahua prioritizes user security and strongly recommends that users set strong, unique passwords for their devices, regularly check security advisories published on the Dahua official website, or use the device's online update feature to upgrade programs to the latest version in a timely manner," the company added.
"For affected users, we recommend performing a full factory reset and updating the firmware to the latest version. If users encounter any issues during the reset process, they can contact Dahua technical support for assistance."
The researchers described the operator as Russian-speaking based on language artifacts recovered from the working directory, but the activity has not been attributed to a named threat actor, a Russian government entity, or another known group. The firm assessed with moderate confidence that parts of the toolkit may have been designed to transfer camera access to a third party.
As of August 19, 2026, the campaign-specific totals of more than 14,530 devices, 1,923 persistent accounts, 283 P2P compromises, and the 89.4% open-channel figure remain attributed to Hunt.io. The public primary sources reviewed for this story corroborate the two old authentication bypasses, the p2pwn tool configuration, and the underlying serial-number P2P mechanism, but do not independently confirm those CameraSwarm counts.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html