Summary Points
- Over 14,530 Dahua devices were compromised through credential attacks, authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045), and peer-to-peer (P2P) relay exploits, primarily targeting devices in Ukraine and Russia.
- Attackers exploited two critical CVEs, rated high severity (CVSS 9.8), enabling bypass of device authentication, with a P2P relay technique allowing access behind NAT, increasing the attack surface.
- The P2P relay vulnerability, capable of establishing unauthenticated access via serial numbers, remains active in firmware released after mid-2024, posing a persistent threat for remote compromise of Dahua cameras.
Threat, Techniques, and Targets
Cybersecurity researchers at Hunt.io have revealed a campaign called Operation CameraSwarm. This campaign compromised over 14,530 Dahua devices between June 17 and July 22, 2026. The attackers used three main methods to gain access. First, they carried out credential attacks. They used more than 12,000 unique IP addresses to execute these attacks. Second, they used two vulnerabilities, CVE-2021-33044 and CVE-2021-33045, to bypass authentication. These flaws allowed the attackers to reach 1,923 cameras. Third, they used a peer-to-peer relay technique. With this, they accessed at least 283 cameras, including those behind NAT. The activity was mainly seen in Ukraine and Russia. The attackers targeted Dahua IP cameras and devices related to Dahua, such as network recorders.
Impact, Implications, and Guidance
The compromise poses several risks. Attackers could control cameras without proper authorization. This may lead to privacy breaches or provide easy access for further attacks. The authentication bypass vulnerabilities are rated highly dangerous, with CVSS scores of 9.8. Dahua has released firmware updates and fixes for these issues. Users are advised to update their devices to the latest firmware from the vendor. ITRES Labs recommends turning off P2P connections if they are not needed. Disabling P2P can prevent relay-based attacks. Users should also use strong, unique passwords. Removing unused accounts and segmenting networks can improve security. If immediate updates are not available, affected users should contact the vendor or a cybersecurity authority for guidance.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
