Full research report
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Executive assessment
The strongest evidence supports a real, large-scale operation that combined ordinary credential abuse with two long-patched authentication bypasses and a separate cloud-relay weakness. CVE-2021-33044 and CVE-2021-33045 are vendor-confirmed, appear in CISA's Known Exploited Vulnerabilities catalogue and have public exploit implementations; CVE-2024-39943 and CVE-2025-31702 do not describe the reported P2P path. ITRES independently established that older Easy4IP firmware can make devices behind network address translation reachable from only a serial number, although device authentication may still intervene. The exact victim count, persistence behaviour on every firmware branch and campaign-specific unauthenticated-relay percentage remain dependent on Hunt.io's analysis of the operator's exposed files. SalatStealer was staged on the same server but should be treated as a separate capability unless further evidence connects it to camera victims.
What happened
Hunt.io reports that a single operator compromised more than 14,530 Dahua devices between 17 June and 22 July 2026, using credential attacks, CVE-2021-33044, CVE-2021-33045 and a separate Easy4IP peer-to-peer relay path. The findings were reconstructed after the operator exposed a working directory on 23 July, and were published on 18 August after notifications to relevant national computer emergency response teams and Dahua. Reported compromises were concentrated in Ukraine and Russia, although scanning and successful access were global.
Affected scope
The confirmed CVEs affect multiple Dahua IP-camera, video-intercom, access-control, pan-tilt-zoom and thermal-device series, with vulnerable build dates varying by product; the vendor advisory identifies pre-June 2021 builds for many CVE-2021-33044-affected products and older cut-offs for CVE-2021-33045. The separate P2P exposure chiefly concerns devices running firmware from before mid-2024 with Easy4IP enabled. Campaign records attribute 12,324 unique IP addresses to credential attacks, 1,923 cameras to the authentication-bypass path and 283 devices to serial-number relay access.
Technical assessment
The two confirmed CVEs allow exposed, unpatched devices to trust attacker-controlled authentication attributes and return an administrator session without valid credentials. The campaign tooling reportedly used the resulting access to add a persistent account, while a structurally separate path enumerated device serial numbers and requested Easy4IP relay connectivity to systems behind network address translation. Independent research confirms the relay can create otherwise unexpected reachability on older firmware, but device-level authentication may still apply; the campaign's claim that 89.4% of live serials opened without authentication has not been independently reproduced.
Recommended defensive actions
- Apply the fixed firmware listed in Dahua DHCC-SA-202106-001, using the vendor download site rather than relying solely on the device update indicator.
- Disable Easy4IP/P2P unless it is operationally essential, and restrict associated outbound connectivity to prevent accidental reactivation.
- Audit every Dahua account list for the reported p2pwn account or other unexplained privileged users, then remove unauthorised accounts.
- Rotate administrator, ONVIF and network-video-recorder credentials stored on or shared with potentially affected cameras.
- Restrict TCP port 37777 and device web-management interfaces from the public internet, placing surveillance systems behind a virtual private network and network segmentation.
- Hunt for NetKeyboard or loopback authentication events, logins recorded from 127.0.0.1, unexpected Easy4IP sessions and configuration changes during or after June 2026.
Uncertainties and evidence gaps
- The 14,530-plus total, 1,923 persistent-account count and 89.4% unauthenticated-relay rate derive principally from recovered operator records and have not been independently validated device by device.
- It is unknown whether the operation continued from different infrastructure after 22 July 2026.
- The operator has not been identified, and Russian-language tooling or regional targeting does not establish state, criminal-group or national attribution.
- The extent to which recovered offline recovery codes remain usable has not been independently confirmed by Dahua or a public-sector authority.
- SalatStealer was present on the same infrastructure, but published evidence does not connect it to compromise of the Dahua devices.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Campaign evidence supports in-the-wild exploitation of CVE-2021-33044 and CVE-2021-33045 between 17 June and 22 July 2026; public exploit tooling is available, but continuing activity after that period is unknown.
The investigation first tested the article's campaign claims against the original Hunt.io publication, then separated campaign evidence from vendor-confirmed vulnerability facts. Dahua, CISA and the original researcher confirm the two 2021 authentication bypasses, while independent ITRES research corroborates the older-firmware P2P exposure without validating the campaign's device counts. Inspection of the other cited identifiers established that CVE-2024-39943 is unrelated and CVE-2025-31702 describes a distinct authenticated flaw, leaving CVE-2021-33044 and CVE-2021-33045 as the only confirmed campaign CVEs.
- What event and claims were initially reported?Reviewed the supplied article and separated its campaign counts, CVE claims, P2P claims and mitigation statements.thehackernews.com ↗
The article reports a 17 June–22 July 2026 campaign affecting more than 14,530 Dahua devices through credentials, two 2021 authentication bypasses and a separate P2P route.
why This framed the investigation while leaving the article's figures and interpretations subject to primary-source verification.
- What does the original campaign research actually establish?Read the full Hunt.io report, including its timeline, path counts, CVE corrections, indicators and mitigations.hunt.io ↗
Recovered operator records attribute 12,324 unique addresses to credential attacks, 1,923 backdoored cameras to the CVE path and 283 devices to P2P access; they also identify the p2pwn account and state that the P2P and CVE paths were separate.
why This is the primary evidence for the campaign, but its device counts remain dependent on interpretation of the recovered records.
- Do the vendor's records confirm the two 2021 flaws and their affected scope?Reviewed Dahua's advisory for CVE-2021-33044 and CVE-2021-33045.dahuasecurity.com ↗
Dahua confirms authentication bypass during login, identifies numerous affected product series and publishes fixed firmware.
why The vendor advisory establishes that the vulnerabilities and repairs are real independently of the 2026 campaign report.
- Is in-the-wild exploitation independently recognised by a government authority?Checked the current CISA Known Exploited Vulnerabilities records for both CVEs.cisa.gov ↗
CISA added both CVEs on 21 August 2024 and describes the NetKeyboard and loopback authentication bypasses as exploited in the wild.
why This corroborates real-world exploitation historically, while not independently proving each device attributed to the 2026 operation.
- Is the serial-number P2P route independently documented?Reviewed ITRES Labs' incident-response and laboratory findings across 2019–2025 firmware branches.labs.itresit.es ↗
ITRES found that pre-mid-2024 firmware could establish an Easy4IP relay route using a valid, enumerable serial number before device-level authentication, while later firmware strengthened the checks.
why This independently supports the existence and defensive significance of the relay exposure, but not Hunt.io's 283-device count or 89.4% result.
- Does CVE-2025-31702 describe the reported unauthenticated P2P behaviour?Compared the P2P claims with Dahua's CVE-2025-31702 advisory.dahuasecurity.com ↗
The advisory describes privilege escalation requiring previously obtained normal-user credentials in builds before 1 July 2025.
why Its access prerequisites and mechanism differ from serial-number relay reachability, so it was excluded from the confirmed campaign CVEs.
- Is public campaign-associated exploit tooling available?Inspected the public p2pwn repository and its documented capabilities.github.com ↗
The repository accepts Dahua serial numbers or prefixes and advertises weak-credential and CVE detection over Dahua protocols.
why This confirms public tooling availability, but the repository alone cannot validate campaign counts or prove current exploitation.
- Can Dahua P2P relay behaviour be demonstrated independently of the campaign toolkit?Inspected the public dh-p2p proof-of-concept repository.github.com ↗
The project implements Dahua P2P device discovery and relay functionality using a device serial number.
why It corroborates the underlying relay capability while not showing that relay reachability always bypasses device authentication.
- Does CVE-2024-39943 have any valid Dahua connection?Checked the National Vulnerability Database assignment for CVE-2024-39943.nvd.nist.gov ↗
The identifier belongs to operating-system command injection in Rejetto HTTP File Server for authenticated users with upload permission.
why The different vendor, product and mechanism establish that its use in the recovered Dahua tooling was an incorrect label.
- Do the original disclosures support the claimed authentication mechanisms and remote access requirements?Reviewed the 2021 full-disclosure record from the researcher credited with both Dahua findings.seclists.org ↗
The researcher identifies CVE-2021-33044 as a NetKeyboard trust failure and CVE-2021-33045 as a loopback trust failure, both remotely reachable without legitimate credentials on affected firmware.
why This independently confirms the technical distinction between the two bypasses and supplies defender-relevant authentication indicators.
Research coverage
All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1671 records | Primary evidence3 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7807 records | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok685 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | failed0 records | Failed1 matched items | The current collection attempt failed; this source cannot support the report. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 12 opened outside the registered collection
Vulnerability & exploitation4
Technical references2
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code3
Public tooling supports serial-number input, weak-credential checks and authentication-bypass testing associated with the campaign.
Independently demonstrates that Dahua devices can be located through the cloud service by serial number and reached through a relay.
The original researcher documents the remote, unauthenticated nature and affected device classes of CVE-2021-33044 and CVE-2021-33045.
Vendor & gov advisories4
Vendor advisory confirms both authentication bypasses, affected product series, firmware build cut-offs and fixed releases.
CISA lists both flaws as exploited in the wild and requires vendor mitigation or discontinuation where mitigation is unavailable.
Confirms CVE-2025-31702 is a separate privilege-escalation flaw requiring normal-user credentials, not the unauthenticated P2P behaviour.
Confirms this identifier belongs to authenticated command injection in Rejetto HFS and was incorrectly attached to Dahua tooling.
Analysis & research3
Primary campaign research reports 14,530-plus compromised devices, three access paths, victim artefacts and the June–July 2026 timeline.
Independent incident-response research corroborates serial-number reachability through Easy4IP on pre-mid-2024 firmware and provides defensive guidance.
Secondary reporting accurately separates the confirmed CVEs from the non-CVE P2P path and highlights uncorroborated campaign-specific figures.