Over 14,500 Dahua Surveillance Devices Hacked via Weak Passwords, Old Flaws and P2P: How to Protect Your CCTV
Threat research firm Hunt.io published a report on 18 August 2026 describing a Dahua camera hack campaign it calls Operation CameraSwarm, and The Hacker News covered it on 19 August 2026. According to Hunt.io, the operator compromised more than 14,530 Dahua surveillance devices between 17 June and 22 July 2026, using weak passwords, two authentication-bypass flaws from 2021 and a route through Dahua’s P2P cloud service.
Confirmed compromises were concentrated in Ukraine and Russia, and the report names no victims in Saudi Arabia. The methods, however, rely on setup mistakes that can exist on any site, so the story matters to anyone running a Dahua CCTV system in the Kingdom.
Key takeaways
- The campaign ran for about 35 days; Hunt.io puts the total at more than 14,530 devices.
- Most compromises (12,324 unique IP addresses) came from password guessing on port 37777.
- 1,923 cameras were taken over through CVE-2021-33044 and CVE-2021-33045, and a persistent account named p2pwn was added to each.
- 283 cameras were reached through the P2P service using only their serial number, including devices behind a router.
- Dahua recommends strong passwords, firmware updates and a full factory reset for affected devices.
How were Dahua cameras hacked in the CameraSwarm campaign?
Hunt.io rebuilt the campaign from a working directory the operator left exposed on its server: 407 MB and 2,616 files of tools and logs. The compromises fall into three paths:
| Attack path | Count per Hunt.io | What the attacker exploited |
|---|---|---|
| Password guessing | 12,324 IP addresses | Weak passwords on port 37777 exposed to the internet |
| Authentication bypass | 1,923 cameras | CVE-2021-33044 and CVE-2021-33045 on old firmware |
| P2P relay | 283 cameras | Reaching the device through Dahua’s cloud servers by serial number |
Dahua disclosed both flaws in security advisory DHCC-SA-202106-001 in 2021. They let an attacker skip the login check with crafted data packets. Dahua rates them 8.1; the US National Vulnerability Database (NVD) rates each 9.8, and both sit in CISA’s Known Exploited Vulnerabilities catalog. The advisory lists the affected models and firmware build dates for each, including builds dated before June 2021 on a number of cameras, covers some NVR and XVR recorders, and names a fixed firmware version for each model.
ITRES Labs describes the P2P path as a weakness without a CVE number. On firmware older than mid-2024, a valid serial number was enough to open an Easy4IP relay path before the device checked credentials; the lab says later firmware hardened this path. The Hacker News notes that a successful relay can make a device reachable, but logging in may still require authentication.
What did Dahua say?
In a comment to The Hacker News, Dahua said the report reflects Hunt.io’s independent research and that the attack methods mainly involve password cracking and the two flaws it disclosed in 2021. It recommends strong, unique passwords, regular checks of its security advisories and timely updates through the device’s online update feature. For affected devices, Dahua recommends a full factory reset followed by an update to the latest firmware, and contacting Dahua technical support if the reset fails.
The activity has not been attributed to any known group. The article also notes that some of Hunt.io’s figures, such as the share of channels open without authentication, had not been independently reproduced by Dahua or anyone else as of 19 August 2026.
What does this mean for Saudi Arabia?
Hunt.io says the scanning was global, even though confirmed compromises were concentrated in Ukraine and Russia. Many camera systems in shops, villas and warehouses are installed with a simple password, the recorder port is forwarded on the router so the phone app works, and the firmware is never updated. Those are exactly the gaps this campaign used. Practical steps, taken from the same sources:
- Passwords: set a strong, unique password on the recorder and on every camera, and remove unused accounts. Hunt.io advises checking the user list for an account named p2pwn and deleting it.
- Firmware: check the firmware build date under Settings, System Information, Version Information, and update from Dahua’s official download center or the device’s update feature. Hunt.io cites Dahua as saying updated firmware stops the attacker from generating valid recovery codes.
- P2P and Easy4IP: disable P2P in the network settings if you do not use it for remote viewing, and restrict Easy4IP connectivity where appropriate.
- Ports: do not leave port 37777 open to the internet on the router.
- Separate network: put cameras and the recorder on a network segment isolated from office PCs and guest Wi-Fi.
- Suspect devices: do a full factory reset and then update, as Dahua advises, and treat old passwords as exposed. Hunt.io warns that the p2pwn account can survive a factory reset on most firmware, so check the user list again afterwards.
AZEIDK Expert Take
This is not a defect in a new camera. It is about devices left on default settings and old firmware. Start with an inventory: the model of every recorder and camera, the firmware date, who holds the passwords, and whether phone viewing runs through P2P or an open port. Our guide to secure DMSS and Hik-Connect setup on your phone covers app setup and user permissions. If your system is Dahua, ask your installer for a record of the updates applied. Firmware and password checks can be added to the visits under annual maintenance contracts for CCTV systems. To review an existing system or design a new one, see security and surveillance systems or talk to the AZEIDK team.
Sources
- Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia, Hunt.io, 18 August 2026
- DHCC-SA-202106-001: Identity authentication bypass vulnerability found in some Dahua products, Dahua PSIRT, 2021 (last updated 12 January 2024)
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P, The Hacker News, 19 August 2026
