Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Hunt.io disclosed OperationCameraSwarm, a campaign compromising 14,530+ Dahua devices between June 17 and July 22, 2026, using credential attacks, authentication bypasses, and P2P relay exploitation Two CVE-2021-33044 and CVE-2021-33045 authentication bypass flaws were used to configure persistent accounts on 1,923 cameras, with the account reportedly surviving factory resets on most firmware A P2P relay technique via Easy4IP allowed 283 cameras behind NAT to be reached using serial numbers, wit
Analysis
TL;DR
- Hunt.io disclosed OperationCameraSwarm, a campaign compromising 14,530+ Dahua devices between June 17 and July 22, 2026, using credential attacks, authentication bypasses, and P2P relay exploitation
- Two CVE-2021-33044 and CVE-2021-33045 authentication bypass flaws were used to configure persistent accounts on 1,923 cameras, with the account reportedly surviving factory resets on most firmware
- A P2P relay technique via Easy4IP allowed 283 cameras behind NAT to be reached using serial numbers, with recovered operator code claiming 89.4% of live serial numbers returned open channels without authentication
- The campaign was reconstructed from a 407 MB exposed working directory containing tooling, logs, and campaign records, with compromises concentrated in Ukraine and Russia
- ITRES Labs recommends disabling P2P where unnecessary, updating to mid-2024 or later firmware, and segmenting video surveillance systems
Why It Matters
This campaign highlights the persistent risks facing IoT and surveillance devices, particularly when legacy vulnerabilities remain unpatched for years despite known exploitation. The combination of credential attacks, authentication bypasses, and P2P relay exploitation demonstrates how multiple attack vectors can be chained to compromise large-scale device fleets, making it a cautionary case study for organizations relying on Dahua and similar IoT infrastructure.
Technical Details
- Credential Attacks: 12,324 unique IP addresses were targeted across 13,229 campaign records, representing the largest attack vector in the operation
- Authentication Bypass (CVE-2021-33044/CVE-2021-33045): CVE-2021-33044 exploits a NetKeyboard client type during authentication, while CVE-2021-33045 uses loopback login requests via 127.0.0.1; both rated CVSS 8.1 (Dahua) to 9.8 (NVD) and remain in CISA's KEV catalog as of August 2026
- P2P Relay Exploitation: The Easy4IPCloud protocol allows device location via serial number and tunnel establishment; firmware before mid-2024 permitted relay path creation before device-level credential checks, with the public p2pwn repository confirming tool support for Dahua serial numbers
- Persistent Account Configuration: 1,923 cameras were configured with persistent accounts that reportedly survive factory resets on most firmware versions
- Evidence Recovery: A 407 MB working directory containing 2,616 files across 234 subdirectories was analyzed, including tooling, logs, shell history, and campaign records
Industry Insight
- Organizations using Dahua surveillance equipment should prioritize firmware updates to mid-2024 or later versions and disable P2P/Easy4IP functionality unless explicitly required for operations
- The continued presence of CVE-2021-33044 and CVE-2021-33045 in CISA's KEV catalog underscores the critical importance of patch management for legacy IoT devices that remain in production environments
- The reported capability to transfer camera access to third parties suggests emerging business models in IoT compromise; defenders should implement network segmentation and monitor for unauthorized account creation on surveillance infrastructure
Disclaimer: The above content is generated by AI and is for reference only.