Dahua CVE-2021-33044/33045: Camera Login Bypass in KEV

What to do

1. Inventory Dahua cameras, recorders and intercoms and read each build time under Settings > System Information > Version.
2. Update anything built before June 2021 to the fix firmware in DHCC-SA-202106-001 or newer, and replace devices that cannot be updated.
3. Remove internet exposure of TCP 37777 and the web interface, and disable Dahua P2P access unless you need it.
4. List user accounts on every device and delete any you did not create, especially one named p2pwn; a firmware update does not remove it.
5. Change device passwords and any credentials stored on the devices.

How to check if you are affected or compromised

• Look for a user named p2pwn; Hunt.io says it survives password changes and, on most firmware, a factory reset.
• Alert on Dahua login requests containing "clientType": "NetKeyboard", or "loginType": "Loopback" with "ipAddr": "127.0.0.1"; Hunt.io says legitimate clients do not send them.
• Search firewall logs for traffic to 154.86.119.60 or 185.132.53.56, the CameraSwarm operator hosts Hunt.io published.
• Review bursts of failed logins on port 37777 using default credentials such as admin:admin or 888888:888888.

What happened#

On September 1, 2021, Dahua published advisory DHCC-SA-202106-001 and fix firmware for two authentication bypasses in the login process of its cameras, recorders and intercoms. In Dahua's words, attackers "can bypass device identity authentication by constructing malicious data packets." Dahua scores both CVSS 3.1 8.1. NVD scores each 9.8. The researcher, bashis, reported them on June 13, 2021, and published full details and a proof-of-concept tool on Full Disclosure on October 6, 2021.

Both bugs abuse the global.login call, with no password needed. With CVE-2021-33044, the client claims to be a "NetKeyboard" controller, and the device skips the password check. It works over Dahua's DHIP protocol and over HTTP. With CVE-2021-33045, the login request claims to come from the loopback address, which the firmware trusts.

On August 21, 2024, CISA added both to the KEV catalog (33044, 33045) "based on evidence of active exploitation," without naming a campaign. SecurityWeek noted it had seen no public reports of malicious use before the warning. The clearest public evidence came later. In August 2026, Hunt.io reconstructed "Operation CameraSwarm" from an operator's exposed working directory. Between June 17 and July 22, 2026, the operator used both bypasses to take over 1,923 cameras. On each one it planted a persistent account named p2pwn. It compromised more than 12,000 other devices by guessing passwords on port 37777. Confirmed victims were mostly in Ukraine and Russia. The Hacker News reported the operator as Russian-speaking, with no attribution to a known group.

Who is affected#

CVE-2021-33044 affects many IPC camera families, VTO door stations, VTH monitors, SD-series PTZ domes and TPC thermal cameras built before June 2021. CVE-2021-33045 affects IPC cameras built before May 2020. Per the CVE record, it also hits intercoms and NVR and XVR recorders built before December 2019. Dahua's advisory lists the exact fix firmware per model. The build time is shown under Settings, System Information, Version.

Do you really need to act?#

Only if you own Dahua equipment, but then yes. The fix is five years old, yet the 2026 campaign shows that unpatched units are still being found and taken over. Hunt.io says unpatched firmware is exploitable "in under a second," and proof-of-concept code has been public since 2021. Exposure is not limited to open ports. The operator also reached 283 cameras through Dahua's P2P relay by serial number, including some behind NAT. Patching alone is not enough after a compromise. Hunt.io says the p2pwn account survives a password change and, on most firmware, a factory reset. For most software teams with no cameras, this is not a concern.

What to do now#

1. List all Dahua cameras, recorders and intercoms and record each build time.
2. Update anything built before mid-2021 to the advisory's fix firmware or newer. Replace devices that cannot be updated.
3. Keep TCP 37777 and the web interface off the internet, and disable P2P unless you need it.
4. Delete unknown user accounts, especially p2pwn, and change all device passwords.

How to tell if you were hit#

• A user named p2pwn on any device is a clear sign of compromise.
• Hunt.io says login requests containing "clientType": "NetKeyboard", or "loginType": "Loopback" with "ipAddr": "127.0.0.1", do not occur in legitimate traffic. Alert on them.
• Search firewall logs for 154.86.119.60 and 185.132.53.56, and for bursts of failed logins on port 37777.

Timeline#

• Jun 13, 2021 — bashis contacts Dahua.
• Sep 1, 2021 — Dahua publishes the advisory and fix firmware.
• Oct 6, 2021 — Full disclosure with a proof-of-concept tool.
• Aug 21, 2024 — CISA adds both CVEs to KEV; federal deadline Sep 11, 2024.
• Jun 17, 2026 — Operation CameraSwarm begins; it runs to July 22.
• Aug 18, 2026 — Hunt.io publishes its report.

Vulnerability records

• CVE-2021-33044 · KEV 2024-08-21 · The identity authentication bypass vulnerability found in some Dahua products during the login process.
• CVE-2021-33045 · KEV 2024-08-21 · The identity authentication bypass vulnerability found in some Dahua products during the login process.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Dahua — DHCC-SA-202106-001: Identity authentication bypass vulnerability found in some Dahua products dahuasecurity.com
2. bashis (Full Disclosure) — [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045) seclists.org
3. CVE record — CVE-2021-33044 cve.org
4. CVE record — CVE-2021-33045 cve.org
5. NVD — CVE-2021-33044 nvd.nist.gov
6. NVD — CVE-2021-33045 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2021-33044 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2021-33045 cisa.gov
9. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Aug 21, 2024) cisa.gov
10. Hunt.io — Operation CameraSwarm: Dahua cameras compromised hunt.io

Coverage and analysis

1. The Hacker News — Hackers compromised 14,500 Dahua devices (Aug 19, 2026) thehackernews.com
2. SecurityWeek — CISA Warns of Exploited Vulnerabilities Impacting Dahua Products securityweek.com