CERT-UA flags Dahua camera takeovers through P2P access

CERT-UA has warned of unauthorized remote access to Dahua video-surveillance equipment in Ukraine. The incidents involve IP cameras and DVRs, with attackers able to view video streams, alter device configurations and create third-party accounts.

The Computer Emergency Response Team of Ukraine said the main initial-access route is Easy4IP, Dahua's peer-to-peer platform for remotely monitoring homes and small businesses. The service connects cameras, NVRs and DVRs to a smartphone application or browser through a QR code or hardware serial number.

Predictable serial numbers expand exposure

CERT-UA said Dahua serial numbers follow a predictable pattern: a 10-character model prefix shared by devices in the same family, followed by an almost sequential five-character hexadecimal counter. The agency gave 7K01F36PCA003E8 as an example.

That structure allows attackers to guess serial numbers at scale and identify devices connected to the cloud without rate limits or lockouts. Systems with P2P functionality enabled can therefore be at risk even when they are not directly reachable from the internet. CERT-UA stressed that an assumed-secret serial number is not a security control.

Passwords and unpatched firmware remain key weaknesses

Attackers may overcome authentication with weak or known passwords, or exploit the authentication-bypass vulnerabilities CVE-2021-33044 and CVE-2021-33045 in outdated Dahua firmware. CERT-UA listed unknown accounts, unauthorized configuration changes and audit records of authentication through the DVRIP protocol from the local address 127.0.0.1 as indicators of compromise associated with this activity.

The alert does not identify the victims, timing, number of affected devices or responsible actor. It does, however, resemble activity described by Hunt.io against IP cameras in Ukraine and Russia. One Russian-speaking operator targeted internet-exposed cameras in Ukraine using known Dahua and Hikvision flaws and compromised 58 devices.

CameraSwarm findings show persistence risks

Hunt.io also documented Operation CameraSwarm, which it attributed to a lone actor and said compromised more than 14,530 Dahua IP cameras between June 17 and July 22, 2026. The campaign scanned TCP port 37777, Dahua's default proprietary management and streaming port, collected serial numbers, then used credential brute forcing and the CVE-2021-33044/CVE-2021-33045 chain.

Hunt.io found persistent p2pwn / p2password backdoor accounts on 1,923 cameras. It said the accounts were installed over RPC and, on most firmware, could survive a password change and factory reset. In 283 cases, cameras were reached through Dahua's cloud relay using the serial number alone, usually without credentials or a device address.

Actions for surveillance operators

CERT-UA recommends disabling P2P where it is not required, avoiding direct internet exposure and keeping software current. Operators should also investigate unknown accounts, unexplained configuration changes and DVRIP authentication events that appear to originate from 127.0.0.1.

For businesses relying on video surveillance, the practical implication is to treat cameras, recorders and their cloud-relay settings as managed security assets: remove unnecessary remote paths, patch vulnerable firmware and use audit evidence to validate that only authorised access remains.