CVE-2021-33044, CVE-2021-33045: Dahua IoT Cameras — Mass Device Compromise via Auth Bypass (June–July 2026)

CVE-2021-33044, CVE-2021-33045 — Dahua IoT Cameras

CVE-2021-33044 and CVE-2021-33045 are critical authentication bypass vulnerabilities (CVSS up to 9.8) in Dahua IoT cameras. Both flaws are actively exploited in the wild, enabling attackers to gain unauthorized access and control over affected devices. Operation CameraSwarm leveraged these CVEs between June 17 and July 22, 2026, resulting in the compromise of over 14,530 Dahua cameras, with persistent unauthorized accounts created on nearly 2,000 devices.

Attack Vector

Attackers combined credential attacks with exploitation of the authentication bypass flaws to gain initial access. Once inside, they established persistent accounts and, in 283 cases, used a peer-to-peer (P2P) relay technique to access devices behind NAT or firewalls. The attack required network accessibility to the device’s management interface or exposure via P2P relay. Indicators include unexpected account creation, anomalous remote logins, and P2P relay traffic to unknown endpoints.

Who Is at Risk

All Dahua Technology IoT cameras and NVRs running unpatched firmware vulnerable to CVE-2021-33044 and CVE-2021-33045 are at risk. The campaign primarily impacted devices in Ukraine and Russia, but the vulnerabilities are global. Devices with P2P enabled or exposed management interfaces are especially vulnerable.

Patch & Mitigate

• Patch: Apply the latest Dahua firmware updates addressing CVE-2021-33044 and CVE-2021-33045 immediately. Check vendor advisories for model-specific patches.
• Workaround: Disable P2P functionality if not required. Restrict device management interfaces to trusted networks only.
• Detect: Audit for new or unauthorized accounts, review logs for remote logins from unusual IPs, and monitor for P2P relay traffic to unfamiliar destinations.

MITRE ATT&CK

• TA0006 — Credential Access: Attackers used brute-force and credential stuffing to gain initial access.
• TA0007 — Persistence: Persistent unauthorized accounts were created to maintain long-term access.

Source: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html