The CameraSwarm campaign targeting Dahua IP cameras is a strong reminder that Internet-connected surveillance devices are not passive appliances. Once compromised, they become remotely accessible computing platforms with network connectivity, credentials, storage and often visibility into sensitive physical environments. Researchers found that more than 14,500 Dahua cameras were compromised during a 35-day campaign running from June 17 to July 22, 2026. The attackers did not depend on a single weakness. They combined brute-force attacks, exploitation of older vulnerabilities and abuse of password-recovery mechanisms to compromise devices at scale.

The campaign appears particularly systematic. One component scanned TCP port 37777 and successfully compromised cameras at 12,324 unique IP addresses through brute-force attacks. Another attack path exploited CVE-2021-33044 and CVE-2021-33045 using a tool called p2pwn, installing a persistent backdoor account named `p2pwn` with the password `p2password` on 1,923 cameras. According to the researchers, this account can survive password changes and, on many firmware versions, even factory resets. A third technique reached 283 cloud-registered cameras behind NAT by using serial numbers and SDK credentials embedded in Dahua applications. The fact that 89.4% of live serial numbers examined reportedly exposed an access channel without authentication makes this part of the campaign especially concerning.

CVE-2021-33044 and CVE-2021-33045 deserve particular attention because they show how old vulnerabilities can remain operationally useful to attackers years after disclosure. Device owners sometimes assume that vulnerabilities in embedded equipment become irrelevant simply because the hardware continues functioning normally. Unfortunately, attackers are less sentimental about firmware age. A camera installed five years ago may still be physically working perfectly while its security posture has quietly deteriorated because nobody has updated the software running inside it. The CameraSwarm operators appear to have taken advantage of exactly this gap.

The persistence mechanism is another serious issue. Changing the administrator password after discovering suspicious activity may not be enough if a separate attacker-created account has already been installed. Hunt.io specifically recommends checking affected cameras for the presence of the `p2pwn` account and removing it. Even then, the researchers warn that deleting the backdoor account does not invalidate password-recovery codes previously generated by the attacker's toolkit. Those codes can remain usable until the underlying derivation mechanism is changed server-side. This means remediation may require more than restoring configuration and changing credentials.

The cloud-relay attack is perhaps the most strategically interesting part of the operation. NAT is frequently assumed to provide meaningful protection because an internal camera is not directly reachable from the public Internet. In this campaign, however, cloud connectivity created an alternative pathway. Attackers could potentially reach cameras through Dahua's relay infrastructure using serial numbers and credentials derived from software components, bypassing the assumption that being behind NAT makes the device inaccessible. This illustrates a broader IoT problem: a device may have no publicly reachable IP address and still maintain an outbound connection to a vendor cloud service that effectively creates a remotely usable management channel.

For enterprises, this should change how network cameras are classified. CCTV devices are often treated as facilities equipment rather than computing infrastructure, so they may be installed by physical-security teams and then left running for years with minimal involvement from cybersecurity teams. Yet these cameras have operating systems, web interfaces, authentication mechanisms, APIs, firmware, cloud connectivity and network services. From an attacker's perspective, that makes them endpoints. The fact that they happen to be bolted to a wall and contain a lens does not grant them some mystical exemption from patch management.

The potential impact also extends beyond viewing camera feeds. A compromised camera can become a foothold inside an organisation's network. Attackers may use it for reconnaissance, proxying traffic, command-and-control, credential attacks or movement toward other internal systems. Because cameras are expected to remain online continuously and typically generate network traffic, malicious communications originating from them may attract less attention than similar behaviour from an employee workstation. An attacker who compromises a sufficiently trusted IoT device may therefore gain a durable presence in an environment without ever installing malware on a conventional endpoint.

This is why cameras and NVR infrastructure should be placed on dedicated network segments rather than connected directly to ordinary user or server networks. Cameras generally need to communicate with a limited set of systems, such as an NVR, video-management server, DNS service, NTP server or specifically approved cloud platform. They rarely need unrestricted access to employee workstations, file servers, domain controllers or database infrastructure. Firewall policies should therefore use a default-deny approach and permit only the communication required for video operations.

Direct Internet exposure should also be eliminated wherever possible. Dahua's TCP port 37777 was heavily scanned and brute-forced during this campaign, so organisations should verify whether this service is accessible from outside their network. If remote administration is required, access should normally occur through a secured VPN, zero-trust access mechanism or restricted management gateway rather than publishing the camera's management interface directly to the Internet. Port forwarding and UPnP rules deserve particular scrutiny because they can unintentionally expose embedded devices that administrators assumed were internal.

Firmware management is equally important. Dahua recommends applying the SA-2021-0130 firmware updates addressing CVE-2021-33044 and CVE-2021-33045, or using a later fixed firmware release. Organisations should therefore maintain an inventory containing camera model, firmware version, serial number, installation location and support status. Without such an inventory, vulnerability management becomes little more than hoping somebody remembers which camera was installed above which doorway sometime during the previous decade.

Password management must also improve. Default credentials, reused passwords and predictable administrator credentials remain highly effective against IoT equipment because these devices are frequently deployed in large numbers using identical configuration templates. Every device should have a unique strong administrative password, and credentials should be stored and managed centrally rather than reused across entire deployments. Where the product supports account lockout, login throttling or MFA for management access, those protections should be enabled.

P2P and vendor-cloud functionality should be disabled when it is not operationally necessary. Cloud connectivity can make remote administration convenient, but it also introduces an additional trust relationship involving vendor infrastructure, device identifiers and remote-access mechanisms. Organisations that manage cameras entirely through local NVRs or secured internal systems should evaluate whether P2P functionality provides enough operational value to justify maintaining that additional external pathway. Hunt.io specifically recommends disabling P2P where it is not needed.

Monitoring should include IoT devices as well. Security teams should establish normal communication patterns for camera networks and alert when a camera begins communicating with unexpected Internet addresses, scanning other internal systems, generating unusually high traffic volumes or connecting directly to endpoints outside the surveillance environment. A camera that normally sends video exclusively to an NVR suddenly initiating connections across multiple subnets should be treated as suspicious even if antivirus software has nothing to say about it. Most cameras do not run conventional endpoint agents, making network-based behavioural monitoring especially important.

Customers should also periodically scan their own public IP ranges to identify unintentionally exposed camera services. External attack-surface management can identify TCP 37777, web interfaces and other management services visible from the Internet. This is important because what the network team believes is exposed and what an attacker can actually discover through Internet-wide scanning are frequently two different lists. CameraSwarm demonstrates how quickly attackers can automate this discovery process across the entire IPv4 space.

If a Dahua camera was reachable through port 37777 during June or July 2026, Hunt.io recommends treating it as potentially compromised. Administrators should inspect local user accounts for `p2pwn`, review device logs where available, verify firmware integrity and update to a fixed release. Passwords should be changed, but that action should be considered only one part of remediation. Where confidence in the device's integrity cannot be established, reflashing the firmware from a trusted vendor image or replacing unsupported hardware may be more appropriate than assuming a factory reset has removed every persistence mechanism.

The campaign also provides a broader lesson about IoT lifecycle management. Enterprise servers and laptops generally have established patching processes, vulnerability scanners and support policies. Surveillance cameras can remain operational for ten years or longer, often with little visibility into whether their firmware is still maintained. This creates a growing population of permanently connected devices whose security support lifecycle may be much shorter than their physical lifespan. Procurement decisions should therefore consider how long vendors provide firmware updates, how vulnerabilities are communicated and whether secure remote-update mechanisms exist.

For security teams, the most useful defensive approach is layered: eliminate unnecessary Internet exposure, patch affected firmware, disable unused P2P services, use unique credentials, isolate camera networks, restrict outbound communication and continuously monitor device behaviour. Network security controls should also prevent a compromised camera from communicating freely with critical internal assets. If compromise of one CCTV camera provides a direct route to the rest of the enterprise network, the architectural problem is larger than the camera vulnerability itself.

CameraSwarm ultimately demonstrates that attackers no longer distinguish between traditional computers and embedded devices in the way many organisations still do. Anything with an IP address, reachable service and exploitable software is part of the attack surface. More than 14,500 compromised cameras in just 35 days shows what happens when Internet-scale scanning meets old vulnerabilities, weak credentials and rarely updated equipment. The security camera intended to watch for intruders can, rather inconveniently, become the intruder's own device inside the network.

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. [...]

Source: Hackers compromise 14,500 Dahua web cameras in 35-day campaign via Bleeping Computer — published 19 Aug 2026.