CERT-UA warns Dahua cameras in Ukraine hijacked via P2P and auth flaws
Original title: Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
Attackers guess Easy4IP serial numbers and use weak passwords or CVE-2021-33044 and CVE-2021-33045 on outdated firmware.
CERT-UA and SSSCIP warned of unauthorized remote access to Dahua IP cameras and DVRs in Ukraine, including video-stream access, configuration changes, and third-party accounts. Initial access uses the Easy4IP P2P service, where predictable serial numbers can be guessed, plus weak or known passwords or authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045. CERT-UA did not name targets, dates, device counts, or an actor. The report is compared with Hunt.io activity, including Operation CameraSwarm, which Hunt.io said compromised over 14,530 Dahua cameras and planted a persistent backdoor account on 1,923.
Unconfirmed: CERT-UA has not identified who was targeted, when, how many devices, or who was responsible.
- Easy4IP serial numbers use a shared 10-character model prefix and a near-sequential five-character counter.
- IoCs include unknown accounts, config changes, and DVRIP logins from 127.0.0.1.
- Hunt.io said one cluster compromised 58 devices in Ukraine using known camera flaws.
- Operation CameraSwarm ran from June 17 to July 22, 2026, according to Hunt.io.
- The backdoor account p2pwn/p2password can survive a password change and, on most firmware, a factory reset.
Impact: Remote video access, config changes, and extra accounts
| Product | Affected |
|---|---|
| Dahua IP cameras and DVRs | outdated firmware |
- 1.Disable P2P if it is not required.
- 2.Do not expose cameras directly to the internet.
- 3.Update device software and look for unknown accounts and DVRIP logins from 127.0.0.1.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110 Brute ForceT1133 External Remote ServicesT1098 Account Manipulation
- Vendors
- Dahua
- Products
- Dahua IP camerasEasy4IP
- Countries
- Ukraine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-33044+1 related CVE | Authentication Bypass in Dahua IP Camera Firmware | 9.8 | 100% | KEVPoC ×2 | KEV |
From the original article
4 min read at thehackernews.com
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP)
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.