CERT-UA: attackers control Dahua cameras and recorders via Easy4IP
Devices with Easy4IP dial out to Dahua’s cloud and can be opened by serial number without a public IP or open ports.
74
- Mentions · 7d3
- Mentions · 30d6
- All mentions8
- First seenAug 19, 2026
- Last mentioned3d ago
Timeline
8 articles · newest firstCERT-UA warns Dahua cameras in Ukraine hijacked via P2P and auth flaws
Attackers guess Easy4IP serial numbers and use weak passwords or CVE-2021-33044 and CVE-2021-33045 on outdated firmware.
76
CERT-UA warns hackers are compromising Dahua surveillance cameras
Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.
72
New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
74
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
58
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
72
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.
64
Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras
One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.
55
Related CVEs
by mentions- CVE-2021-33044100%9.8Authentication Bypass in Dahua IP Camera Firmware
- CVE-2021-33045100%9.8Authentication Bypass in Dahua IP Cameras, NVRs and Video Intercoms
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2025-3132499%9.8Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
- CVE-2024-327298%9.8Hard-Coded Backdoor Credentials in End-of-Life D-Link NAS Devices
- CVE-2024-3273100%9.8Command Injection in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS Devices
- CVE-2024-3994337%8.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload…
- CVE-2025-31702<1%6.8A vulnerability exists in certain Dahua embedded products
Appears with
- Easy4IPproduct · 4
- Hunt.ioorganization · 3
- Dahua IP camerasproduct · 3
- Pawns.appproduct · 3
- Hikvisionvendor · 3
- GreyNoiseorganization · 3
- Ubiquitivendor · 3
- SAP NetWeaver Visual Composerproduct · 3
- SAPvendor · 3
- D-Link ShareCenterproduct · 3
- D-Linkvendor · 3
- CERT-UAorganization · 3
- Dahua camerasproduct · 2
- IPRoyalorganization · 2
- Ubiquiti UniFi Videoproduct · 2
- Dahua video recordersproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.