Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns
Dahua IP cameras, NVRs and DVRs (Easy4IP P2P cloud access)
Ukraine's CERT-UA warns that attackers are taking over Dahua IP cameras, NVRs and DVRs: they watch the video stream, change device settings and add their own accounts. The main way in is Dahua's P2P cloud access (Easy4IP), which reaches devices by serial number through the manufacturer's cloud, bypassing NAT and firewalls. Serial numbers follow a predictable pattern, so attackers appear to guess them in bulk, meaning any device with P2P turned on is at risk even if it is not exposed to the internet. Logins are then beaten with weak or default passwords or, on outdated firmware, the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The methods match Hunt.io's Operation CameraSwarm, which compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 and left a backdoor account on 1,923 of them, though no link between the two has been shown. Turn off P2P/Cloud Access if you don't need it, keep cameras off the open internet, remove unknown accounts and update firmware.
Why this severity: Active exploitation confirmed by CERT-UA; the two auth-bypass CVEs are CVSS 9.8 and in CISA KEV, while the P2P serial-number exposure has no firmware fix
- Started
- Oct 26, 2026
Affected
- Dahua IP cameras, NVRs and DVRs with P2P/Cloud Access (Easy4IP) enabled
- Dahua devices on firmware older than the fixes for CVE-2021-33044 and CVE-2021-33045
Fixed in
- Firmware with Dahua's fixes for CVE-2021-33044 and CVE-2021-33045 (see Dahua's advisory); no fix for the P2P serial-number exposure, which is mitigated by turning P2P off
Timeline3
The Record and The Hacker News report the CERT-UA warning; Hunt.io says the methods closely match CameraSwarm but there is no evidence it is the same attacker, and that removing rogue accounts is not enough without a firmware update.
CERT-UA warns of confirmed takeovers of Dahua IP cameras and recorders through Easy4IP P2P cloud access, with predictable serial numbers, weak passwords and CVE-2021-33044/33045 on old firmware. Signs of compromise: unknown accounts, unexpected config changes or text overlays on video, and DVRIP logins from 127.0.0.1 in the audit log.
Hunt.io publishes Operation CameraSwarm: one operator compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 by brute-forcing passwords, chaining CVE-2021-33044 and CVE-2021-33045, and reaching 283 cameras by serial number alone through Dahua's cloud relay. A backdoor account (p2pwn / p2password) was left on 1,923 cameras.
Advisories3
News & write-ups4
- Зловмисники можуть отримати контроль над камерами та відеореєстраторами Dahua через хмарний доступ (CERT-UA warning)ITWeek · Oct 26, 2026
- Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and RussiaHunt.io · Aug 18, 2026 · Write-up
- Ukraine warns hackers are exploiting Chinese-made Dahua surveillance camerasThe Record · Oct 27, 2026
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth WeaknessesThe Hacker News · Oct 27, 2026
Posts1
🚨 Dahua IP cameras compromised in Ukraine. CERT-UA confirms attackers gained access to video feeds, changed device settings, and created rogue accounts. The attacks exploit Easy4IP P2P access alongside weak passwords or authentication bypass flaws. Full details ↓ t.co/6iQsjw6avS
Get an email when a new major security incident drops. No spam, unsubscribe any time.
