Operation CameraSwarm exploitation of Dahua authentication-bypass flaws

Attackers used **CVE-2021-33044** and **CVE-2021-33045** to access **Dahua** devices during **Operation CameraSwarm**, combining the authentication-bypass flaws with credential attacks and a peer-to-peer relay path. Hunt.io said the operation compromised **more than 14,530 Dahua devices** between June 17 and July 22, 2026, left **1,923 cameras** configured with a persistent account, and reached **283 cameras** through the P2P path. Confirmed compromises were concentrated in **Ukraine** and **Russia**, and the activity was reconstructed from a **407 MB** exposed working directory containing **2,616 files** across **234 subdirectories**. The two Dahua flaws affect device login by letting attackers bypass identity checks, and they remain operationally relevant because both are tracked as known exploited vulnerabilities. Affected product scope in the available material spans Dahua IP cameras and related products, with additional listed families including video intercom, NVR, XVR, PTZ dome, and thermal camera devices. Available material also mentions **CVE-2024-39943** and **CVE-2025-31702**, but it does not establish that those CVEs explain the P2P behavior used in this operation. **CISA** continues to keep **CVE-2021-33044** and **CVE-2021-33045** in the **Known Exploited Vulnerabilities** catalog and directs operators to apply vendor mitigations or discontinue use if mitigations are unavailable. **Dahua** says fixed firmware is available, while severity scoring differs between Dahua's advisory at **8.1 CVSS** and NVD at **9.8 CVSS** for each flaw. The immediate defensive priority is to patch or replace exposed Dahua devices and review unnecessary P2P exposure on fleets that may still be reachable through the same paths.