CERT-UA: attackers control Dahua cameras and recorders via Easy4IP
Original title: Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP
Devices with Easy4IP dial out to Dahua’s cloud and can be opened by serial number without a public IP or open ports.
Ukraine’s CERT-UA said in an October 23, 2026 alert that attackers gained unauthorized remote access to Dahua IP cameras and video recorders through the Easy4IP cloud feature. They viewed live video, changed settings, and created their own accounts. Easy4IP registers a device by serial number, so access can bypass NAT and firewalls. The alert does not name victims or say how many devices were affected.
Unconfirmed: CERT-UA did not name targets or device counts, and it only says attackers may use the cited authentication-bypass flaws.
- Serial numbers follow predictable patterns that attackers may guess and test in the cloud.
- Weak passwords or CVE-2021-33044 and CVE-2021-33045 may bypass login on old firmware.
- Cloud access can appear as DVRIP logins from the local address 127.0.0.1.
- CERT-UA says every device with active P2P functionality is at risk.
- Unknown accounts and unexpected on-screen text are listed as compromise signs.
Impact: Live video viewing, setting changes, and new accounts
| Product | Affected |
|---|---|
| Dahua IP cameras and video recorders with Easy4IP | — |
- 1.Disable unused P2P and cloud access and keep cameras off the internet.
- 2.Use a VPN and allow only authorized IP addresses for remote access.
- 3.Update firmware manually, remove unknown accounts, and unlink unknown cloud accounts.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-33044+1 related CVE | Authentication Bypass in Dahua IP Camera Firmware | 9.8 | 100% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityaffairs.com
Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.