CVE-2021-33044
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: the identity authentication bypass vulnerability found in some Dahua products during the login process. EPSS 100% (100th percentile).
CISA federal remediation date Sep 11 · date passed
Vulnerabilities & Exploits · Web App Attack
Hunt.io says Operation CameraSwarm compromised more than 14,530 Dahua IP cameras and NVRs between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and Dahua's serial-number P2P route. The team said 1,923 devices were left with persistent accounts and 283 were reached through P2P.
The important part is persistence. The attackers did not need the cameras to be openly exposed on the internet: Dahua's P2P relay can create a route to a device by serial number before normal login checks finish, and the bypass flaws let them get in without standard authentication. That means a password reset alone may not close the door if a planted account or P2P access remains.
For teams running Dahua cameras or NVRs, the exposure sits at the device layer and can survive the perimeter they think is doing the blocking. If P2P remote access is enabled, a hidden camera can still be reachable from outside the network, and cleanup has to account for access paths that outlive simple credential changes.
3 sources · Aug 20
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: the identity authentication bypass vulnerability found in some Dahua products during the login process. EPSS 100% (100th percentile).
CISA federal remediation date Sep 11 · date passed
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: the identity authentication bypass vulnerability found in some Dahua products during the login process. EPSS 100% (100th percentile).
CISA federal remediation date Sep 11 · date passed
SecurityWeek
Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia
Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks.
originalBleepingComputer
Hackers compromise 14,500 Dahua web cameras in 35-day campaign
In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.
originalThe Hacker News
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Researchers say Operation CameraSwarm compromised 14,530+ Dahua devices using credential attacks, auth bypass flaws, and P2P relays.
originalPart of the PlainSec briefing for 2026-08-19
Every edition of this story: Hunt.io Finds Dahua Cameras Kept Reconnecting