CERT-UA: Dahua cameras hijacked through the Easy4IP cloud
CERT-UA reports Dahua cameras and NVRs taken over via the Easy4IP P2P feature, even with no exposed ports. Attack vector, indicators and what to do.
CERT-UA, Ukraine’s computer emergency response team, has issued an alert about unauthorized remote access to Dahua IP cameras and video recorders. According to Security Affairs, the alert is dated 23 October 2026; The Record, which covered it on 26 October, places it at the end of the previous week. The attackers changed device settings and created accounts of their own. The story was also covered by The Hacker News, whose text could not be consulted for this article: the details that follow come from The Record and Security Affairs.
What happened
The alert does not say how many devices were compromised, who the victims are or who is behind the attacks; according to The Record, it does not say when the attacks took place either. The two outlets differ in tone on access to the footage: Security Affairs says the attackers watched the live video, while The Record speaks of video feeds being potentially exposed and of devices that can be controlled remotely.
Context matters: according to The Record, Chinese-made surveillance equipment is widely used in Ukraine, including by public bodies and military units, and there have long been fears that cameras could be used to watch military movements and critical infrastructure. It is not known whether the devices in the alert belong to government or military organizations.
Technical details
The vector: Easy4IP. The entry point is Dahua’s P2P/cloud feature, Easy4IP. When it is enabled, the device opens an outbound connection to the manufacturer’s cloud infrastructure on its own and registers there with its serial number. From then on, anyone who knows the serial number can reach it through the cloud, bypassing NAT and firewall, with no published ports and no public IP address. CERT-UA’s conclusion, quoted by Security Affairs, is clear: not being directly reachable from the internet does not guarantee the security of a device with P2P enabled.
Predictable serial numbers. According to both outlets, serial numbers follow predictable patterns: an attacker can generate many of them automatically and check which devices are registered in the cloud. Keeping the serial number private is not enough.
Getting past authentication. Once the device is found, the login remains. Two routes are mentioned:
- weak or default passwords;
- flaws in outdated firmware, in particular CVE-2021-33044 and CVE-2021-33045, disclosed in 2021, which allow attackers to bypass authentication without a password. On vulnerable firmware, even a strong password offers no protection.
Persistence. According to Hunt.io, speaking to The Record, malicious accounts and recovery codes created by the attackers can survive a password change and, on most firmware versions, even a factory reset. Removing the accounts without updating the firmware is not enough to secure the device.
Indicators of compromise (from the alert, as reported by Security Affairs):
- accounts you did not create;
- changed settings, including text overlaid on the video image (their absence does not mean the device is clean);
- in the audit logs, logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, a possible sign of access through the cloud.
The sources do not report IP addresses or other network indicators.
MITRE ATT&CK (our mapping from the reported facts): T1190 (Exploit Public-Facing Application) for the authentication bypass, T1110 (Brute Force) for password guessing, T1078.001 (Valid Accounts: Default Accounts), T1136 (Create Account), T1098 (Account Manipulation), T1125 (Video Capture).
The summer precedent
The Record recalls that in August the firm Hunt.io described the compromise of more than 14,500 Dahua devices earlier in the summer, with confirmed infections concentrated in Ukraine and Russia. Hunt.io says the techniques described by CERT-UA closely match those of that campaign, but there is no evidence that the same attackers are involved. The servers used back then are still online; no new copies of the attackers’ toolkit have been found since July, but according to Hunt.io this does not mean the attacks have stopped, as the operators seem to have restricted access to the files that had exposed them. These details come from The Record only.
Impact for European and Italian companies
The sources mention no victims outside Ukraine, but there is nothing local about the mechanism: it affects any Dahua device with Easy4IP enabled, wherever it is installed. The main lesson is that the perimeter does not protect a camera that connects outward on its own: the ports stay closed, but the device opens the channel itself. In Italy and across Europe, Dahua cameras and NVRs are common in offices, shops, warehouses, car parks and healthcare facilities, often installed by third parties and never updated again.
A compromised camera exposes images of premises, entrances and people, with GDPR implications. For NIS2 entities, Article 21 requires vulnerability handling and security in the acquisition and maintenance of systems: video surveillance systems connected to the corporate network fall within the scope to be managed. In healthcare facilities, where cameras may film wards and patients, the issue also concerns the confidentiality of health data.
What to do now
- Inventory all Dahua devices on your networks, including forgotten ones and those managed by the installer, with model and firmware version.
- Disable P2P/Easy4IP where it is not needed: this is CERT-UA’s first recommendation.
- Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
- Update the firmware manually to the latest version and set up a regular update routine: this is the fix for CVE-2021-33044 and CVE-2021-33045.
- Check the device accounts and the linked cloud accounts, and disconnect any you do not recognize. After a compromise, update the firmware before considering the device clean: accounts and recovery codes can survive a reset.
- Look for the indicators: text overlaid on the video, changed settings, DVRIP logins from 127.0.0.1 in the audit logs.
- Filter outbound traffic from the camera network, allowing only the destinations it needs: if P2P is not needed, the firewall can also block connections to the manufacturer’s cloud.
How ARXDOME helps
ARX Watch finds devices without a probe on the network, such as cameras and video recorders, and alerts you when a new one appears: it is the starting point for the inventory. ARX Sentry collects firewall logs and brings them into the SOC pages and the NOC map, including blocked outbound traffic: if you shut down P2P connections from the camera network, the devices’ attempts remain visible. ARX Expose shows open ports and recognized products on public services from the outside, which helps with directly exposed cameras; access via Easy4IP, however, does not go through public ports and is countered mainly from inside the network.
Last updated:
