{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns · updates",
  "home_page_url": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026",
  "feed_url": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/feed.json",
  "description": "Ukraine's CERT-UA warns that attackers are taking over Dahua IP cameras, NVRs and DVRs: they watch the video stream, change device settings and add their own accounts. The main way in is Dahua's P2P cloud access (Easy4IP), which reaches devices by serial number through the manufacturer's cloud, bypassing NAT and firewalls. Serial numbers follow a predictable pattern, so attackers appear to guess them in bulk, meaning any device with P2P turned on is at risk even if it is not exposed to the internet. Logins are then beaten with weak or default passwords or, on outdated firmware, the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The methods match Hunt.io's Operation CameraSwarm, which compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 and left a backdoor account on 1,923 of them, though no link between the two has been shown. Turn off P2P/Cloud Access if you don't need it, keep cameras off the open internet, remove unknown accounts and update firmware.",
  "language": "en",
  "_pwn": {
    "slug": "dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-10-27-e9b7a46f",
      "url": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-10-27-e9b7a46f",
      "title": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: The Record and The Hacker News report the CERT-UA warning; Hunt.io says the methods closely match CameraSwarm but there is no evidence it is the same attacker, and that removing rogue accounts is not enough without a firmware update.",
      "content_text": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: The Record and The Hacker News report the CERT-UA warning; Hunt.io says the methods closely match CameraSwarm but there is no evidence it is the same attacker, and that removing rogue accounts is not enough without a firmware update.\n\nSource: https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-10-26-fb6b7ffa",
      "url": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-10-26-fb6b7ffa",
      "title": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: CERT-UA warns of confirmed takeovers of Dahua IP cameras and recorders through Easy4IP P2P cloud access, with predictable serial numbers, weak passwords and CVE-2021-33044/33045 on old firmware. Signs of compromise: unknown accounts, unexpected config changes or text overlays on video, and DVRIP logins from 127.0.0.1 in the audit log.",
      "content_text": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: CERT-UA warns of confirmed takeovers of Dahua IP cameras and recorders through Easy4IP P2P cloud access, with predictable serial numbers, weak passwords and CVE-2021-33044/33045 on old firmware. Signs of compromise: unknown accounts, unexpected config changes or text overlays on video, and DVRIP logins from 127.0.0.1 in the audit log.\n\nSource: https://itweek.com.ua/2026/10/26/zlovmysnyky-mozhut-otrymaty-kontrol-nad-kameramy-ta-videoreyestratoramy-dahua-cherez-hmarnyj-dostup/",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://itweek.com.ua/2026/10/26/zlovmysnyky-mozhut-otrymaty-kontrol-nad-kameramy-ta-videoreyestratoramy-dahua-cherez-hmarnyj-dostup/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-08-18-c3b25cd7",
      "url": "https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026#2026-08-18-c3b25cd7",
      "title": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: Hunt.io publishes Operation CameraSwarm: one operator compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 by brute-forcing passwords, chaining CVE-2021-33044 and CVE-2021-33045, and reaching 283 cameras by serial number alone through Dahua's cloud relay. A backdoor account (p2pwn / p2password) was left on 1,923 cameras.",
      "content_text": "Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns: Hunt.io publishes Operation CameraSwarm: one operator compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 by brute-forcing passwords, chaining CVE-2021-33044 and CVE-2021-33045, and reaching 283 cameras by serial number alone through Dahua's cloud relay. A backdoor account (p2pwn / p2password) was left on 1,923 cameras.\n\nSource: https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised",
      "date_published": "2026-08-18T00:00:00.000Z",
      "external_url": "https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised",
      "tags": [
        "high"
      ]
    }
  ]
}