Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

Ukraine warns attackers are hijacking Dahua cameras via Easy4IP

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 27: Security Affairs dates the CERT-UA alert to October 23, 2026, and adds that every active-P2P device is at risk, with unexpected on-screen text as a sign.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CERT-UA says attackers are remotely taking over Dahua cameras and recorders in Ukraine through Easy4IP; no actor or device count is named.

Ukraine’s CERT-UA said in an October 23, 2026 alert that attackers gained unauthorized remote access to Dahua IP cameras and video recorders in Ukraine, viewing live video, changing settings, and creating accounts. The Hacker News also cites SSSCIP. Access uses Dahua’s Easy4IP cloud feature, which reaches devices by serial number despite firewalls, NAT, and the lack of a public IP, plus weak or default passwords or authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 on outdated firmware. CERT-UA did not name victims, timing of the compromises, device counts, or an actor, and The Record notes it is unclear whether any devices belong to Ukrainian agencies or military units. Hunt.io separately said Operation CameraSwarm compromised over 14,530 Dahua cameras from June 17 to July 22, 2026, and planted a persistent backdoor account on 1,923.

Key facts
  • CERT-UA alert dated October 23, 2026; no actor, victims, or counts named.
  • Easy4IP registers devices by predictable serial numbers and can bypass firewalls.
  • Named flaws are CVE-2021-33044 and CVE-2021-33045 on outdated firmware.
  • Hunt.io: over 14,530 cameras hit June 17–July 22, 2026; backdoor on 1,923.
  • Hunt.io said one cluster compromised 58 devices in Ukraine.
  • CERT-UA says every device with active P2P functionality is at risk.
Analyze CVE-2021-33044 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jun 17, 2026Hunt.io says Operation CameraSwarm began · The Hacker News
  2. Jul 22, 2026Hunt.io says Operation CameraSwarm ended · The Hacker News
  3. Oct 23, 2026CERT-UA warned of unauthorized Dahua camera access · Security Affairs

What each outlet adds

beyond the shared facts
  • The RecordNotes it is unclear if agencies or military units were hit.
  • The Hacker NewsCites SSSCIP, CameraSwarm dates, 1,923 backdoors, and 58 Ukrainian devices.
  • Security AffairsDates the CERT-UA alert October 23 and flags all active P2P devices.
CVEs
CVE-2021-33044CVE-2021-33045
Vendors
Dahua
Products
Dahua IP camerasEasy4IPDahua video recordersDahua cameras
Organizations
CERT-UASSSCIPHunt.io
Countries
UkraineChinaRussia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago The RecordFirst report

    CERT-UA warns hackers are compromising Dahua surveillance cameras

    Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.

  2. · 3d ago The Hacker News

    CERT-UA warns Dahua cameras in Ukraine hijacked via P2P and auth flaws

    Attackers guess Easy4IP serial numbers and use weak passwords or CVE-2021-33044 and CVE-2021-33045 on outdated firmware.

  3. · 3d ago Security Affairs

    CERT-UA: attackers control Dahua cameras and recorders via Easy4IP

    Devices with Easy4IP dial out to Dahua’s cloud and can be opened by serial number without a public IP or open ports.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2021-33044
+1 related CVE
CVE-2021-33045
Authentication Bypass in Dahua IP Camera Firmware
9.8100%KEVPoC ×2
KEV