Operation CameraSwarm: 14,530 Dahua Cameras Compromised via Legacy Auth Bypass Flaws

Cybersecurity researchers at Hunt.io have uncovered Operation CameraSwarm, a large-scale campaign that compromised more than 14,530 Dahua surveillance devices between June 17 and July 22, 2026. The activity was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including attacker tooling, logs, shell history, and campaign records. Confirmed intrusions were concentrated in Ukraine and Russia, with 1,923 cameras configured with a persistent attacker-controlled account and 283 additional devices reached through a peer-to-peer (P2P) relay path.

Hunt.io attributed the 14,530-plus total to three distinct attack paths. Credential attacks accounted for the bulk of activity, with 12,324 unique IP addresses appearing across 13,229 campaign records, often targeting factory-default or weak passwords that admins never changed. The authentication-bypass vector exploited two long-patched flaws, CVE-2021-33044 and CVE-2021-33045, affecting Dahua IP cameras and related products. Dahua rates both CVEs at 8.1 on the CVSS scale, while the U.S. National Vulnerability Database assigns them a more severe 9.8. A third path used a P2P relay that establishes routes without prior authentication, leaving login enforcement to the device's web application, a setup that also exposed devices sitting behind network address translation (NAT). Admins exposed to the open internet can audit open services with a port scanner and verify their source IPs via WHOIS lookup.

The technical mechanics of the two 2021 flaws remain effective against unpatched firmware. CVE-2021-33044 is triggered by a NetKeyboard client type during authentication, while CVE-2021-33045 abuses a loopback login request using the 127.0.0.1 address, allowing attackers to bypass device identity authentication by crafting malicious data packets. Both vulnerabilities remain listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of August 19, 2026, advising federal agencies and operators to apply vendor mitigations or discontinue use. A publicly accessible repository, p2pwn, still accepts Dahua serial numbers as input, checks for both CVEs, and ships with a default dummy-account configuration, though it does not independently confirm Hunt.io's count of 1,923 cameras or its claim that the rogue account survives a factory reset on most firmware.

Dahua has shipped fixed firmware for both flaws and recommends users install the corresponding patch or newer releases. ITRES Labs, which published its own analysis in October 2025, advises disabling P2P functionality wherever it is not operationally required and validating firmware against the vendor's official download site to defeat supply-chain tampering. Organizations running Dahua deployments should also enforce strong, unique credentials and rotate any default passwords, a baseline check that can be cross-referenced with a password strength checker. With thousands of internet-exposed cameras still answering on legacy authentication paths, Operation CameraSwarm illustrates how five-year-old CVEs continue to fuel modern botnet-scale intrusions against IoT fleets.