Researchers at Hunt.io uncovered what they call Operation CameraSwarm — a systematic campaign that compromised more than 14,530 Dahua IP cameras and related devices between June 17 and July 22, 2026. The attackers left behind an exposed working directory with 2,616 files: tooling, shell history, and campaign logs that let researchers reconstruct the full operation. Three attack paths accounted for all compromised devices: credential stuffing across 12,324 unique IPs, authentication bypass using CVE-2021-33044 and CVE-2021-33045 (which together added 1,923 persistent backdoor accounts), and a P2P relay technique that reached 283 cameras even when they sat behind NAT — no open inbound port required. Confirmed compromises were concentrated in Ukraine and Russia, though the technique itself is not geography-specific.
CVE-2021-33044 and CVE-2021-33045 are authentication-bypass flaws in Dahua’s IP cameras and NVRs, rated CVSS 9.8 by the National Vulnerability Database and still listed in CISA’s Known Exploited Vulnerabilities catalog as of today. Both were patched by Dahua in 2021, but Operation CameraSwarm’s success at scale shows a large install base has never applied the update. The P2P relay path is especially concerning: a public tool called p2pwn accepts a camera’s serial number as input, checks for both CVEs, and injects a default dummy account — all without the device being reachable from the public internet in the conventional sense.
How to check if you’re affected
Affected devices are Dahua IP cameras and NVRs running firmware versions older than the 2021 security release that addresses CVE-2021-33044 and CVE-2021-33045. Check your device’s current firmware version against Dahua’s official download site and apply the latest update. If you cannot update immediately, CISA advises discontinuing use of unmitigated affected devices. Disable P2P connectivity in the device settings if you do not need remote cloud access — this removes the relay attack surface entirely. Devices reachable only via P2P are still vulnerable, so disabling the feature is the most effective quick mitigation while firmware updates are arranged.