Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Summary: Hunt.io researchers disclosed Operation CameraSwarm, a campaign they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a P2P relay technique, reconstructed from a 407 MB exposed working directory of 2,616 files. Hunt.io reported 1,923 cameras configured with a persistent account and 283 reached through the P2P path, with confirmed compromises concentrated in Ukraine and Russia; both 2021 flaws remain in CISA's KEV catalog as of August 19, 2026.
Key Takeaway: The two flaws doing the work are from 2021 and still in CISA's KEV catalog, and ITRES Labs found that on firmware before mid-2024 a valid serial number alone could open an Easy4IP relay path to a device behind NAT before its own credential check ran. Hunt.io's campaign-specific figures, including 89.4% of live serial numbers returning an open channel without authentication, have not been independently reproduced by Dahua, ITRES Labs, or a public CERT advisory.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-33044CVE-2021-33045CVE-2024-39943CVE-2025-31702
- Related
- CVE-2021-33044: Dahua IP Camera Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 21, 2024