CameraSwarm Exposes the IoT Persistence Problem: Dahua Backdoors That Survive Factory Resets

As reported by BleepingComputer, researchers at Hunt.io uncovered the CameraSwarm campaign—a 35-day operation that compromised 14,530 Dahua IP cameras primarily across Ukraine and Russia. The campaign combined brute-forcing, exploitation of two 2021 CVEs, and a novel cloud-relay attack leveraging camera serial numbers to generate offline recovery codes. What makes this story significant isn't just the scale—it's what the campaign reveals about the structural weaknesses in how IoT devices are designed, deployed, and maintained.

Vulnerability Details

Affected vendor: Dahua Technology
Affected products: Dahua IP cameras, NVRs, VTH devices reachable via TCP port 37777 or registered to Dahua cloud
Backdoor indicator: Account named p2pwn with password p2password

Why This Matters Beyond the Headline

Persistence That Survives Factory Resets

The most alarming technical detail is that the p2pwn backdoor account persists through password changes and, on most firmware versions, survives factory resets. This fundamentally breaks the standard incident response playbook for IoT devices. Organizations that detect compromise and factory-reset a camera may believe they've remediated the issue while the attacker retains full access. Defenders must verify account lists directly, not assume a reset equals remediation.

The persistence mechanism in CameraSwarm means that for compromised Dahua cameras, 'factory reset' is not remediation—it is theater.

Serial Numbers as Authentication Tokens

The cloud-relay attack is arguably the most innovative and concerning vector. By deriving offline recovery codes from camera serial numbers—using SDK credentials embedded in Dahua's own applications—the operator bypassed authentication entirely on 89.4% of live serials tested. This isn't a patchable vulnerability in the traditional sense; it's a design decision that treats a printed serial number as a trust anchor. Any camera whose serial number is physically visible, photographed, or leaked in supply chain records becomes a potential target.

Five-Year-Old CVEs Still Work

The fact that CVE-2021-33044 and CVE-2021-33045—both disclosed in 2021—were successfully exploited across nearly 2,000 cameras in mid-2026 illustrates the chronic IoT patching gap. Camera firmware is rarely updated after initial deployment. Organizations treat cameras as set-and-forget appliances, not networked computers requiring lifecycle management. Attackers know this and will continue targeting old CVEs on embedded devices for years to come.

Misleading CVE References Suggest Operational Deception

The inclusion of CVE-2024-39943 and CVE-2025-31702 in the toolkit—CVEs not actually exploited in the campaign—may indicate deliberate attribution obfuscation. Threat actors increasingly seed false indicators in their tooling to mislead analysts. Security teams should be cautious about assuming exploit chains based solely on references found in attacker tooling.

Who Is at Risk

Immediate Actions

• Audit all Dahua devices: Check every camera and NVR for the presence of a p2pwn user account. Remove it immediately if found.
• Update firmware: Apply the latest Dahua firmware that patches CVE-2021-33044 and CVE-2021-33045. Verify the patch was applied by re-checking account lists post-update.
• Block TCP port 37777 at perimeter firewalls and network segmentation boundaries. Cameras should never be internet-facing.
• Disable cloud relay if not required for operations. If P2P cloud access is necessary, enforce strong unique admin passwords and monitor for unauthorized account creation.
• Inventory serial numbers: Treat camera serial numbers as sensitive credentials. Restrict physical access to devices and audit any documentation containing serials.
• Network segmentation: Place all IP cameras on an isolated VLAN with no internet egress and strict access controls to the video management system.

Shield53 Recommendations

Treat this campaign as a wake-up call for IoT lifecycle governance, not a one-off patching exercise:

• Implement continuous firmware inventory for all networked physical security devices. You cannot defend what you haven't inventoried, and you cannot patch what you don't track.
• Adopt a zero-trust posture for IoT: No camera should have direct internet access. All remote access should route through a VPN or hardened gateway with MFA.
• Establish post-remediation verification procedures that go beyond factory resets. For Dahua devices specifically, query the user account list via the device API after any remediation action.
• Monitor for indicators of compromise: Deploy network detection rules for outbound connections to Telegram API endpoints from camera VLANs, and alert on any new local account creation on embedded devices.
• Engage with your physical security vendor on cloud-relay functionality. If serial numbers can be used to bypass authentication, demand technical documentation on how the recovery process is secured and whether it can be disabled.
• Brief physical security teams: IT and physical security departments must coordinate. A compromised camera is both a cybersecurity incident and a physical security breach—attackers can observe guard patrols, access points, and sensitive areas in real time.

The CameraSwarm campaign demonstrates that the intersection of physical and cybersecurity remains critically underdefended. Until organizations treat surveillance cameras as the networked computers they are—requiring the same patching cadence, access controls, and monitoring as servers—campaigns like this will continue to scale.