Dahua Camera Backdoor Survives Password Changes and Factory Resets on Compromised Devices

A large campaign has compromised more than 14,000 internet-connected Dahua cameras, exposing how vulnerable surveillance equipment can become a gateway to video feeds and device settings.

The operation ran for 35 days, and hit devices worldwide, with confirmed compromises centered in Ukraine and Russia. It shows how unattended devices can create durable, long-lasting hidden access for intruders.

The operator scanned for exposed camera management services, tried weak credentials, and used two known authentication-bypass flaws against unpatched devices.

It also used a cloud relay path that can reach cameras behind network address translation by serial number, so even non-public devices could be targeted.

Analysts at Hunt.io identified the activity after finding an openly exposed operator directory containing 2,616 files and campaign tooling.

Hunt.io said in a report shared with Cyber Security News (CSN) the recovered material revealed parallel attack paths, persistent access, and an unrelated Windows payload.

The impact goes beyond unauthorized viewing. The toolkit collected credentials, captured camera snapshots, and exported device records in a format designed for large-scale administration.

Researchers also found offline recovery-code generation, creating a route to administrative resets that can remain useful even after a device owner changes a password.

Dahua Camera Backdoor Survives Password Changes

The most serious finding is persistence. After gaining administrator access through CVE-2021-33044 or CVE-2021-33045, the tool adds a separate account through the camera’s remote management interface.

That account is stored independently from the main administrator password, so changing the password does not remove it. On most affected firmware, a factory reset also fails to erase the hidden access. Hunt.io counted 1,923 cameras carrying the account.

That changes the response from a routine password reset into a compromise investigation, especially for organizations using cameras at sensitive sites.

The two flaws used for initial entry have patches available, yet exposed and unpatched cameras remain attractive targets. Readers can see why direct exposure matters in this coverage of threat actors targeting IP cameras, which also tracks authentication weaknesses affecting surveillance devices.

One exploit path impersonates a trusted hardware controller, while the other claims the request came from the camera itself. Both can provide administrator access without a valid password.

Researchers cautioned that a label used in the toolkit for the persistent-account technique points to an unrelated vulnerability, so defenders should focus on the observed behavior rather than that incorrect identifier.

Recovery Codes Expand Risk

The campaign also abused a cloud relay capability to find and contact cameras using serial numbers. According to the recovered logs, 89.4 percent of live serials tested returned a channel that did not require authentication.

That route can bypass the protection normally offered by placing a camera behind a home or business router. Attackers then generated recovery codes offline for live devices.

These codes can support password recovery without knowing the current device credentials. This makes the threat more durable: removing the unauthorized account may not end access.

Organizations should audit every camera account, remove the unauthorized account when found, rotate camera and linked recorder credentials, and review whether footage or passwords were accessed.

Administrators should also disable P2P features when they are not needed, restrict the management service to trusted internal networks, and apply the vendor update that fixes the two bypasses.

Unpatched-camera abuse also appeared in Iranian operations targeting US networks, underlining that camera security is now an operational concern, not a minor maintenance task.

Firmware updates are essential because they prevent new recovery codes from being generated and cause earlier codes to be refreshed and eventually invalidated.

Network teams should alert on suspicious controller or loopback login patterns, while Windows teams should investigate broad security-tool exclusions.

For broader context on the risks posed by exposed video equipment, see the FBI warning on webcam and DVR attacks and the analysis of automated camera exploitation toolkit.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.