Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
- ID
- 15627
- Status
- summarized
- Published
- 19 Aug 2026, 7:34 PM
- Fetched
- 19 Aug 2026, 10:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 19 Aug 2026, 10:43 PM
- Tags
- Audience
- developers
What happened
Researchers at Hunt.io disclosed 'Operation CameraSwarm,' a campaign that compromised over 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks (12,324 IPs), two 2021 auth-bypass CVEs (1,923 cameras), and a P2P relay path (283 cameras). The campaign was reconstructed from a 407 MB exposed working directory with 2,616 files, and confirmed compromises were concentrated in Ukraine and Russia.
Why it matters
If you deploy or manage Dahua cameras or similar IoT devices, check firmware against the vendor's download site and disable P2P where it is not required—both CVE-2021-33044 and CVE-2021-33045 remain unpatched in many deployments despite fixes being available, and the P2P relay path can reach devices behind NAT without prior authentication.
Discussion angle
The P2P relay technique that reaches devices behind NAT without authentication is the interesting part for builders—discuss how IoT cloud relay architectures create attack surfaces that bypass traditional network perimeter assumptions.