CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Dahua IP Camera

product · product:dahua-ip-camera single-source-national-cert

Coverage
1
first 2026-11-02 → last 2026-11-02
Latest activity
2026-11-02
CERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off
Peak priority
notable
1 notable
Targets
·
regions: europe
Sources cited
5
5 hosts

Action items (1)

Do-now tasks recorded on the entries about Dahua IP Camera, newest first. Check the date before acting on an older one.

  • Turn off Easy4IP (P2P cloud access) on every Dahua camera and recorder that does not need it, and search each device's audit log for DVRIP logins from 127.0.0.1.
    2026-11-02CVE-2021-33044 +1

Defender insights

What each entry about Dahua IP Camera tells a defender to do, newest first.

2026-11-02NOTABLEexploitedCERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off

Exposure · triage · detection

Story timeline

  1. 2026-11-02Dahua cameras and recorders: CERT-UA warns that attackers take devices over through the Easy4IP cloud relay even when no port is exposed, then view video, change configuration and add accounts
    active-threatsCERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off

Hunting pivots

CVEs (exploited first)
CVE-2021-33044CVE-2021-33045
Releases covered
Dahua IP Camera
Tags
actively-exploitedauth-bypasscisa-kevpatch-available
ATT&CK techniques (5 across 4 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExternal Remote Services · Exploit Public-Facing Application
  • PersistenceExternal Remote Services · Create Account: Local Account
  • Credential AccessBrute Force: Password Guessing
  • CollectionVideo Capture

Initial Access TA0001

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

Persistence TA0003

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

Credential Access TA0006

T1110.001Brute Force: Password Guessing×1

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

Collection TA0009

T1125Video Capture×1

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Evidence: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua · ATT&CK page ↗

Entries about Dahua IP Camera (1)

2026-11-02 · view entry permalink →

NOTABLECVE-2021-33044 +1exploitedNATOA2

Dahua cameras and recorders: CERT-UA warns that attackers take devices over through the Easy4IP cloud relay even when no port is exposed, then view video, change configuration and add accounts

CERT-UA's alert (CERT-UA, 2026-10-23; dated 2026-10-23 by Security Affairs, 2026-10-27) reports recorded compromises of Dahua IP cameras and DVRs in which attackers had the video stream, changed the device configuration and created accounts of their own (The Hacker News, 2026-10-27). The main vector is Easy4IP, Dahua's peer-to-peer remote-access feature: a device with it enabled opens an outbound connection to Dahua's cloud and registers by serial number, and access then runs through the cloud, bypassing NAT and firewall, with no published port and no public address (CERT-UA, 2026-10-23; Security Affairs, 2026-10-27). Serial numbers follow a predictable pattern, a 10-character model prefix and a five-character hexadecimal counter that rises almost sequentially, so attackers can guess them at scale and learn which devices are cloud-connected without hitting rate limits (The Hacker News, 2026-10-27). Authentication is then beaten with weak or known passwords or with the authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 in outdated firmware, which CISA added to its Known Exploited Vulnerabilities catalogue on 2024-08-21, although their use in the October cases remains unconfirmed (eSecurity Planet, 2026-10-27). Dahua fixed both in 2021 with model-specific firmware builds and rates them CVSS 8.1 (Dahua, 2021-11-15). CERT-UA does not say who was targeted, how many devices are affected or who is behind the activity (The Hacker News, 2026-10-27).

The Hacker News says the activity shares similarities with Hunt.io's earlier Operation CameraSwarm, which reported more than 14,530 Dahua cameras compromised between 2026-06-17 and 2026-07-22 with brute-forced credentials and the same two-flaw chain, nearly 2,000 of them given a backdoor account that survives a password change and, on most firmware, a factory reset (The Hacker News, 2026-10-27); eSecurity Planet says no connection to the October incidents has been established (eSecurity Planet, 2026-10-27). Dutch intelligence services warned in July that Russian state actors compromise IP cameras to collect intelligence on military transports (The Hacker News, 2026-10-27).

Triage: a login from 127.0.0.1 shows only that the session arrived through the P2P relay, so where staff or an installer legitimately use Easy4IP it is normal; the account name, the time and the configuration change that follows separate the two.

Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded

The Hacker News 2026-10-27

CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

Security Affairs 2026-10-27

Audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.

using a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain.

The Hacker News 2026-10-27

although their use in the October incidents remains unconfirmed.

eSecurity Planet 2026-10-27

Builds on: Dutch intelligence: Russia hijacked default-credential internet cameras along military-supply…

threat02 Nov 03:46Zsingle-source · national CERTOpen finding →
Sources: CERT-UA (State Service of Special Communications and Information Protection of Ukraine) · The Hacker News · Security Affairs · eSecurity Planet · Dahua Technology (DHCC-SA-202106-001)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • cip.gov.ua1 (20%)
  • dahuasecurity.com1 (20%)
  • esecurityplanet.com1 (20%)
  • securityaffairs.com1 (20%)
  • thehackernews.com1 (20%)
All cited sources (5)