CERT-UA warns hackers are compromising Dahua surveillance cameras
Original title: Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.
Ukraine's CERT-UA said hackers compromised internet-connected Dahua cameras and video recorders, changed settings and created unauthorized accounts. The agency did not say how many devices were hit, when, or who was responsible. Access appears tied to the Easy4IP cloud feature, predictable serial numbers, weak or default passwords, or authentication-bypass flaws including CVE-2021-33044 and CVE-2021-33045.
Unconfirmed: CERT-UA did not identify the attackers, timing or device count, and any link to the Hunt.io incidents is unclear.
- Easy4IP connects devices to Dahua's cloud by serial number despite firewalls.
- CERT-UA named CVE-2021-33044 and CVE-2021-33045, disclosed in 2021.
- Hunt.io reported more than 14,500 Dahua devices compromised earlier in the summer.
- It is unclear whether any devices belong to Ukrainian agencies or military units.
Impact: unauthorized camera access, video exposure and remote control
| Product | Affected |
|---|---|
| Dahua cameras and video recorders | — |
- 1.Disable Easy4IP remote cloud access on Dahua cameras and recorders.
- 2.Replace default or weak passwords on exposed Dahua devices.
- 3.Update outdated firmware that CERT-UA says can bypass authentication.
- Vendors
- Dahua
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-33044+1 related CVE | Authentication Bypass in Dahua IP Camera Firmware | 9.8 | 100% | KEVPoC ×2 | KEV |
From the original article
3 min read at therecord.mediaCERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.