Act
active
Operation CameraSwarm: 14,500+ Dahua Devices Compromised via Auth Bypasses
- Engineer — Act: If your environment includes Dahua cameras or NVRs, audit for these two auth-bypass CVEs and enforce credential rotation immediately; also review whether P2P relay features are exposed to the internet and disable if not required.
- SOC/IR — Plan: Build detections for unusual outbound P2P relay traffic from camera subnets and sweep network logs for connections to Dahua cloud relay infrastructure since June 17, 2026; full IOC set not confirmed in enrichment signals but Hunt.io research may provide indicators.
- Leader — Learn: Large-scale IoT compromise campaign is worth noting for vendor risk assessments if Dahua devices are deployed in physical security infrastructure, but no immediate leadership action is required absent confirmed breach at your organization.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.