How do I check whether I am affected by CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b?

On Dahua cameras/NVRs/DVRs: look for user accounts you did not create (CameraSwarm planted a backdoor account p2pwn / p2password that survives password changes and, on most firmware, factory reset); unexplained configuration changes; audit log entries showing authentication over the DVRIP protocol from 127.0.0.1 (sign of P2P/Easy4IP access). Check whether P2P/Easy4IP is enabled, whether TCP 37777 is reachable from the internet, and whether firmware still has CVE-2021-33044/33045.

Live › campaign › CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b

Go to dashboard

high⚡ Early warning · no CVE yetCameraSwarmExploited in the wildInfrastructure

Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Q: What is the fix for CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b?

Turn off P2P/Easy4IP on Dahua devices unless you need it. Do not expose the devices (TCP 37777, web UI) to the internet. Update firmware to versions that fix CVE-2021-33044/33045. Change default or weak passwords. Remove unknown accounts; if you find p2pwn or other rogue accounts, assume the device is compromised and reflash or replace it. Put cameras on an isolated network segment.

CERT-UA (Ukraine) warned the week of 2026-10-20 about confirmed compromises of Dahua IP cameras, NVRs and DVRs: attackers view video streams, change device settings and create their own accounts. They find devices through Dahua's Easy4IP P2P cloud by brute-forcing serial numbers, which follow a predictable pattern, so devices with P2P on can be reached even when they sit behind a firewall/NAT and are not exposed to the internet. They then log in with weak or known passwords, or use old auth bypass flaws in outdated firmware (CVE-2021-33044, CVE-2021-33045). Anyone running Dahua cameras/recorders with P2P (Easy4IP) on is at risk. CERT-UA did not say which targets, how many devices, when it started or who is behind it. The pattern matches Hunt.io's Operation CameraSwarm (14,530+ Dahua cameras compromised 2026-06-17 to 2026-07-22, mostly in Ukraine and Russia), but CERT-UA has not linked the two.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

high

no CVSS yet; severity from the sources

known so far5 of 6

missing: primary source

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 07:12 UTC. All times on this page are UTC.

Who is affected

3 products

Product	Ecosystem	Affected	Fixed in
Dahua IP cameras	vendor	devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045	–
Dahua NVR/DVR	vendor	devices with Easy4IP P2P enabled and weak passwords or outdated firmware	–
Dahua Easy4IP	vendor	P2P cloud access feature	–

Who cares: campaign, dahua, early-warning, ip-camera
Not affected if: –

How to check

On Dahua cameras/NVRs/DVRs: look for user accounts you did not create (CameraSwarm planted a backdoor account p2pwn / p2password that survives password changes and, on most firmware, factory reset); unexplained configuration changes; audit log entries showing authentication over the DVRIP protocol from 127.0.0.1 (sign of P2P/Easy4IP access)
Check whether P2P/Easy4IP is enabled, whether TCP 37777 is reachable from the internet, and whether firmware still has CVE-2021-33044/33045

Know the next one before it finds you.

Add to Slack

Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Dahua IP cameras

vendor

devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

–

Dahua NVR/DVR

vendor

devices with Easy4IP P2P enabled and weak passwords or outdated firmware

–

Dahua Easy4IP

vendor

P2P cloud access feature

–

Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Who is affected

How to check

Know the next one before it finds you.

Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources