# Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns · pwn.watch > Ukraine's CERT-UA warns that attackers are taking over Dahua IP cameras, NVRs and DVRs: they watch the video stream, change device settings and add their own accounts. The main way in is Dahua's P2P cloud access (Easy4IP), which reaches devices by serial number through the manufacturer's cloud, bypassing NAT and firewalls. Serial numbers follow a predictable pattern, so attackers appear to guess them in bulk, meaning any device with P2P turned on is at risk even if it is not exposed to the internet. Logins are then beaten with weak or default passwords or, on outdated firmware, the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The methods match Hunt.io's Operation CameraSwarm, which compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 and left a backdoor account on 1,923 of them, though no link between the two has been shown. Turn off P2P/Cloud Access if you don't need it, keep cameras off the open internet, remove unknown accounts and update firmware. Page: https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026 · generated 2026-10-27T09:13:27.545Z ## Status - Severity: high · status: live · patch: partial - Product: Dahua IP cameras, NVRs and DVRs (Easy4IP P2P cloud access) - Started: 2026-10-26 - CVEs: CVE-2021-33044, CVE-2021-33045 - Affected: Dahua IP cameras, NVRs and DVRs with P2P/Cloud Access (Easy4IP) enabled; Dahua devices on firmware older than the fixes for CVE-2021-33044 and CVE-2021-33045 - Fixed in: Firmware with Dahua's fixes for CVE-2021-33044 and CVE-2021-33045 (see Dahua's advisory); no fix for the P2P serial-number exposure, which is mitigated by turning P2P off ## Follow this incident - RSS (one item per update): https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026.json - This file: https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: The Record and The Hacker News report the CERT-UA warning; Hunt.io says the methods closely match CameraSwarm but there is no evidence it is the same attacker, and that removing rogue accounts is not enough without a firmware update. (https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked) - 2026-10-26: CERT-UA warns of confirmed takeovers of Dahua IP cameras and recorders through Easy4IP P2P cloud access, with predictable serial numbers, weak passwords and CVE-2021-33044/33045 on old firmware. Signs of compromise: unknown accounts, unexpected config changes or text overlays on video, and DVRIP logins from 127.0.0.1 in the audit log. (https://itweek.com.ua/2026/10/26/zlovmysnyky-mozhut-otrymaty-kontrol-nad-kameramy-ta-videoreyestratoramy-dahua-cherez-hmarnyj-dostup/) - 2026-08-18: Hunt.io publishes Operation CameraSwarm: one operator compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 by brute-forcing passwords, chaining CVE-2021-33044 and CVE-2021-33045, and reaching 283 cameras by serial number alone through Dahua's cloud relay. A backdoor account (p2pwn / p2password) was left on 1,923 cameras. (https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised) ## Fix brief # Security brief: Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns Source: https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 09:12 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Ukraine's CERT-UA warns that attackers are taking over Dahua IP cameras, NVRs and DVRs: they watch the video stream, change device settings and add their own accounts. The main way in is Dahua's P2P cloud access (Easy4IP), which reaches devices by serial number through the manufacturer's cloud, bypassing NAT and firewalls. Serial numbers follow a predictable pattern, so attackers appear to guess them in bulk, meaning any device with P2P turned on is at risk even if it is not exposed to the internet. Logins are then beaten with weak or default passwords or, on outdated firmware, the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The methods match Hunt.io's Operation CameraSwarm, which compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 and left a backdoor account on 1,923 of them, though no link between the two has been shown. Turn off P2P/Cloud Access if you don't need it, keep cameras off the open internet, remove unknown accounts and update firmware. Severity detail: Active exploitation confirmed by CERT-UA; the two auth-bypass CVEs are CVSS 9.8 and in CISA KEV, while the P2P serial-number exposure has no firmware fix - Product: Dahua IP cameras, NVRs and DVRs (Easy4IP P2P cloud access) - CVE / advisory ids: CVE-2021-33044, CVE-2021-33045 ## Affected versions - Dahua IP cameras, NVRs and DVRs with P2P/Cloud Access (Easy4IP) enabled - Dahua devices on firmware older than the fixes for CVE-2021-33044 and CVE-2021-33045 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Firmware with Dahua's fixes for CVE-2021-33044 and CVE-2021-33045 (see Dahua's advisory); no fix for the P2P serial-number exposure, which is mitigated by turning P2P off After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes On Dahua cameras, NVRs and DVRs, turn off P2P/Cloud Access (Easy4IP) unless you need it, and don't expose the devices directly to the internet; use a VPN with an IP allowlist for remote viewing. Check local and linked cloud accounts and remove any you don't recognize, look for DVRIP logins from 127.0.0.1 in the audit log, and update the firmware manually to the latest version, since a backdoor account can survive a password change. ## Latest updates - Oct 27, 2026: The Record and The Hacker News report the CERT-UA warning; Hunt.io says the methods closely match CameraSwarm but there is no evidence it is the same attacker, and that removing rogue accounts is not enough without a firmware update. - Oct 26, 2026: CERT-UA warns of confirmed takeovers of Dahua IP cameras and recorders through Easy4IP P2P cloud access, with predictable serial numbers, weak passwords and CVE-2021-33044/33045 on old firmware. Signs of compromise: unknown accounts, unexpected config changes or text overlays on video, and DVRIP logins from 127.0.0.1 in the audit log. - Aug 18, 2026: Hunt.io publishes Operation CameraSwarm: one operator compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 by brute-forcing passwords, chaining CVE-2021-33044 and CVE-2021-33045, and reaching 283 cameras by serial number alone through Dahua's cloud relay. A backdoor account (p2pwn / p2password) was left on 1,923 cameras. ## Advisories - [Dahua advisory: CVE-2021-33044](https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582) (Dahua) - [NVD: CVE-2021-33044](https://nvd.nist.gov/vuln/detail/CVE-2021-33044) (NVD) - [NVD: CVE-2021-33045](https://nvd.nist.gov/vuln/detail/CVE-2021-33045) (NVD) ## Write-ups & news - [Зловмисники можуть отримати контроль над камерами та відеореєстраторами Dahua через хмарний доступ (CERT-UA warning)](https://itweek.com.ua/2026/10/26/zlovmysnyky-mozhut-otrymaty-kontrol-nad-kameramy-ta-videoreyestratoramy-dahua-cherez-hmarnyj-dostup/) - [Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia](https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised) - [Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras](https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked) - [Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses](https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html) --- Machine-readable: https://pwn.watch/i/dahua-cameras-easy4ip-p2p-hijacking-ukraine-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.