Dahua cameras and recorders: CERT-UA warns that attackers take devices over through the Easy4IP cloud relay even when no port is exposed, then view video, change configuration and add accounts
CERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off
Defender actions
- Turn off Easy4IP (P2P cloud access) on every Dahua camera and recorder that does not need it, and search each device's audit log for DVRIP logins from 127.0.0.1.
Analysis
CERT-UA's alert (CERT-UA, 2026-10-23; dated 2026-10-23 by Security Affairs, 2026-10-27) reports recorded compromises of Dahua IP cameras and DVRs in which attackers had the video stream, changed the device configuration and created accounts of their own (The Hacker News, 2026-10-27). The main vector is Easy4IP, Dahua's peer-to-peer remote-access feature: a device with it enabled opens an outbound connection to Dahua's cloud and registers by serial number, and access then runs through the cloud, bypassing NAT and firewall, with no published port and no public address (CERT-UA, 2026-10-23; Security Affairs, 2026-10-27). Serial numbers follow a predictable pattern, a 10-character model prefix and a five-character hexadecimal counter that rises almost sequentially, so attackers can guess them at scale and learn which devices are cloud-connected without hitting rate limits (The Hacker News, 2026-10-27). Authentication is then beaten with weak or known passwords or with the authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 in outdated firmware, which CISA added to its Known Exploited Vulnerabilities catalogue on 2024-08-21, although their use in the October cases remains unconfirmed (eSecurity Planet, 2026-10-27). Dahua fixed both in 2021 with model-specific firmware builds and rates them CVSS 8.1 (Dahua, 2021-11-15). CERT-UA does not say who was targeted, how many devices are affected or who is behind the activity (The Hacker News, 2026-10-27).
The Hacker News says the activity shares similarities with Hunt.io's earlier Operation CameraSwarm, which reported more than 14,530 Dahua cameras compromised between 2026-06-17 and 2026-07-22 with brute-forced credentials and the same two-flaw chain, nearly 2,000 of them given a backdoor account that survives a password change and, on most firmware, a factory reset (The Hacker News, 2026-10-27); eSecurity Planet says no connection to the October incidents has been established (eSecurity Planet, 2026-10-27). Dutch intelligence services warned in July that Russian state actors compromise IP cameras to collect intelligence on military transports (The Hacker News, 2026-10-27).
Triage: a login from 127.0.0.1 shows only that the session arrived through the P2P relay, so where staff or an installer legitimately use Easy4IP it is normal; the account name, the time and the configuration change that follows separate the two.
Cited evidence
Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded
CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.
Audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.
using a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain.
although their use in the October incidents remains unconfirmed.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.