One operator breached 14,530 Dahua cameras in 35 days — 89% without a password
Between June 17 and July 22, 2026, a single operator compromised more than 14,530 Dahua cameras by chaining brute force, a 2021 flaw and the vendor’s P2P relay — 89% of them with no authentication at all. Hunt.io’s investigation reveals a hard truth: connected video surveillance is an open door by design.
June 17, 2026. 14,530 cameras. 35 days. A single operator compromised more than 14,530 Dahua IP cameras and recorders — concentrated in Ukraine and Russia — between June 17 and July 22, 2026. The Hunt.io investigation reconstructs the campaign from a working directory the attacker left exposed: 2,616 files spanning 407 MB, documenting every step. The heaviest detail: 89% of the cameras reached through the vendor’s P2P relay responded without requiring any authentication.
A campaign rebuilt from the attacker’s own mistake
The discovery, on July 23, 2026, rests on an operational blunder. Hunt.io’s AttackCapture crawler flagged activity on TCP/37777, Dahua’s Easy4IP binary management protocol, and traced it back to an open HTTP directory on the operator’s staging server. File timestamps and shell history tell a five-week story: reconnaissance and brute forcing began June 18, relay testing a week later, the CVE-based bypass chain deployed on July 12, and the largest scanning wave ran on July 22 — the day before exposure.
The toolkit is not a single author’s work: its components trace to at least six different upstream developers, assembled and progressively rewritten across three language layers — Spanish, Russian and English.
The three intrusion paths
The operator ran three paths in parallel, which explains both the scale and the resilience of the campaign:
- Brute force. An asyncio engine scaling from 300 to 4,000 concurrent workers tried default and weak credentials against port 37777, using a hand-built implementation of the Easy4IP login protocol. It reached 12,324 unique IP addresses.
- Authentication bypass. Where brute force failed, the p2pwn tool chained CVE-2021-33044 and CVE-2021-33045, two 2021 flaws rated CVSS 9.8, to return a full administrator session in under a second, with no valid password.
- P2P relay. A separate toolkit abused Dahua’s cloud relay (
easy4ipcloud.com), using the SDK credentials embedded in every legitimate client to reach cameras behind NAT by serial number alone.
The relay result is the central figure: roughly 9 out of 10 live serials probed returned an open, no-authentication channel. In other words, most of these compromises required neither a guessed credential nor a CVE — just a serial number and a relay designed to work.
The backdoor that survives a reset
After each bypass, p2pwn installed an account named p2pwn / p2password over RPC. The account is stored independently of the admin password: it survives a password change and, on most firmware, a factory reset. A separate module reproduced Dahua’s account-recovery flow entirely offline, deriving a transferable administrative recovery code for every live serial it verified — independent of the device’s real credentials.
Every captured credential and screenshot went straight to a Telegram channel, while an export routine batched results into SMART PSS-compatible XML for bulk import into Dahua’s own enterprise management platform. The campaign left a persistent backdoor on 1,923 cameras, with 283 more reached through the serial-only path.
Beyond the raw count, the transferable nature of the harvested access is what makes remediation slow. Because the offline recovery-code generator grants administrative control by serial number, an operator who loses the backdoor account can still re-enter any device for which a recovery code was derived. That is why Dahua’s guidance to invalidate outstanding codes on updated firmware is not optional — it is the only control that closes the door the backdoor account leaves open.
What to fix, in order
Remediation is a concrete list, because some damage survives a plain patch:
- Audit and remove the p2pwn account. Any camera reachable on port 37777 between June and July should be checked. Removal is manual: a factory reset will not clear it on most firmware.
- Disable P2P in network settings unless actively required. The relay routes through a pool of backend addresses rather than a fixed server, so address-based blocking does not stop it.
- Apply patch SA-2021-0130. CVE-2021-33044 and CVE-2021-33045 have been fixed since October 2021; unpatched firmware is fully compromised in under a second.
- Update firmware to invalidate outstanding offline recovery codes, then rotate all credentials, including those cached in NVRs via ONVIF lateral movement.
- Detect login requests carrying a NetKeyboard client type or a loopback source address — signatures of the observed bypasses.
The P2P relay: an open door by design
The 89% figure deserves a closer look, because it explains the whole campaign. Dahua’s P2P relay was built so a camera behind a home router could be reached from the mobile app without opening a port and without network configuration. To do that, it accepts a request addressed by serial number, and authenticates it with SDK credentials embedded in every legitimate client — secrets that are public by construction.
The result is a channel that bypasses NAT, firewall and authentication in a single move. ONVIF lateral movement compounds the damage: a compromised camera queries the neighboring NVR, harvests its cached credentials, and spreads access across the whole fleet. That is how one campaign reached thousands of devices with so little effort.
There is an irony worth noting. The entire operation came to light only because the operator’s own OPSEC failed — an open HTTP directory exposed the working toolkit. Defenders cannot count on such luck twice; the design flaw that made the campaign cheap remains present on every unpatched, P2P-enrolled camera today.
The three paths compare like this:
| Path | Access required | Speed | Persistence |
|---|---|---|---|
| Brute force (37777) | None, guesses credentials | Slow | p2pwn account |
| CVE-2021-33044/33045 | None (unpatched firmware) | Under a second | p2pwn account |
| P2P relay | Serial number | Immediate | Recovery code |
The reading is immediate: none of these paths requires knowing a valid password. The device’s security rests entirely on its network isolation, not on its authentication.
Verdict
If you operate Dahua cameras, start from the assumption that a device exposed on port 37777 or enrolled in P2P between June and July is already compromised, not merely at risk. Auditing the p2pwn account and disabling P2P come before patching: those are what neutralize access already installed.
If you design or deploy video surveillance, the lesson is architectural. The 89% of open, no-auth channels is not a bug you patch — it is a design choice in the P2P relay that favors easy setup over security. As long as that choice stands, no patch closes the door; it has to be segmented instead: a dedicated network, no direct internet exposure, and the cloud relay off by default.