CERT-UA warns of Dahua IP camera and DVR hijacking in Ukraine via Easy4IP P2P abuse and auth bypass flaws
CERT-UA and SSSCIP have warned of unauthorized remote access to Dahua IP cameras and DVRs in Ukraine, including access to video streams, configuration changes and creation of third-party accounts. The CERT-UA alert is dated October 23, 2026 (securityaffairs.com). The main initial access vector is the Easy4IP P2P platform. Its serial numbers are predictable, so attackers can enumerate them at scale without hitting rate limits. Authentication is then bypassed with weak or known passwords or with flaws in outdated firmware. CERT-UA did not disclose the victims, timing, number of devices or the responsible actor. The activity resembles two clusters previously reported by Hunt.io, including Operation CameraSwarm, which compromised more than 14,530 Dahua cameras. Dutch intelligence also warned in July 2026 that Russian actors use compromised IP cameras for military espionage.
Entenda a falha
A vulnerabilidade
CERT-UA and SSSCIP report hijacking of Dahua IP cameras, DVRs and NVRs in Ukraine, giving attackers the video stream, configuration changes and rogue accounts. The main entry point is a design weakness in the Easy4IP P2P platform: serial numbers are predictable, so any device with P2P active can be enumerated even if it is not exposed to the internet. Authentication is then beaten with weak or known passwords, or with CVE-2021-33044 and CVE-2021-33045, authentication bypasses in outdated Dahua firmware that allow passwordless login. The articles give no fixed firmware versions, only that outdated firmware is affected. Related Hunt.io activity also used older flaws in Hikvision, D-Link, Reolink, TP-Link and MikroTik devices (CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-36260, CVE-2024-53375, CVE-2024-57049).
Como funciona
With Easy4IP enabled, the camera or recorder opens an outgoing connection to Dahua's cloud and registers by serial number. Users then reach it from a phone app or browser by scanning a QR code or typing the serial number, with no open port or public IP, bypassing NAT and firewall. Serial numbers combine a 10-character model prefix with a five-character, almost sequential hexadecimal counter, so attackers can guess them at scale and check which are registered, with no rate limits or lockouts. After finding a device, they must pass its login by guessing credentials or using the CVE-2021-33044/33045 bypass. Access via P2P appears in audit logs as DVRIP authentication from 127.0.0.1. In CameraSwarm, Hunt.io also describes scanning TCP port 37777, collecting serial numbers and installing a backdoor account over RPC after a bypass.
Por que é vulnerável
For Easy4IP, the root cause is a wrong security assumption: the serial number is treated as if it were secret, yet it follows a predictable structure and the platform does not throttle enumeration. CERT-UA says that assuming nobody knows the serial number is no reason to consider a device secure. For CVE-2021-33044 and CVE-2021-33045, the articles only describe authentication bypasses in outdated firmware, without detail on the coding error. Weak or default passwords and unpatched firmware keep devices exposed. Updating firmware closes the bypasses, and disabling P2P removes the enumeration path.
Como foi descoberta
CERT-UA and SSSCIP issued an alert, dated October 23, 2026, after recording compromises of cameras and DVRs in Ukraine. They did not disclose the victims, timing, number of devices or the responsible actor. The activity resembles two clusters Hunt.io had reported earlier: a Russian-speaking operator that compromised 58 devices in Ukraine, and Operation CameraSwarm, a lone actor that compromised over 14,530 Dahua cameras between June 17 and July 22, 2026. A July 2026 Dutch intelligence bulletin warned that Russian actors use compromised IP cameras for military intelligence. CVE-2021-33044 and CVE-2021-33045 are older, already known flaws.
PoC pública
No PoC repository is linked. The articles say the Russian-speaking operator integrated Ingram, a publicly available webcam vulnerability scanner, to exploit these Dahua flaws among others, so tooling for them is public. Hunt.io reports in-the-wild exploitation, including the CVE-2021-33044/33045 chain used to install a backdoor account on 1,923 cameras. Patching and disabling P2P are therefore urgent, and a factory reset may not remove the backdoor on most firmware.
Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 09:18.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2021-36260. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Hikvision Web Server Build 210702 - Command Injection
This script exploits CVE-2021-36260, an unauthenticated command injection in the web server of Hikvision IP cameras, reached through a crafted XML request to a web-language configuration endpoint. The attacker only needs network access to the camera's web port and a firmware build that has not been patched; no login or user interaction is required. It runs commands as root, returns their output, can reboot the device and can open a persistent SSH backdoor with a passwordless account. It is a working, mature exploit with a safe check mode, so exposed cameras should be patched and kept off the internet.
Detalhes técnicos
- Easy4IP serial numbers consist of a 10-character model prefix shared by a device family and a five-character hexadecimal counter incremented almost sequentially (e.g. 7K01F36PCA003E8). This allows brute-force enumeration to find cloud-connected devices, so all devices with P2P enabled are at risk even if not directly internet-exposed. The device registers with Dahua's cloud by serial number and access is established via the cloud, bypassing NAT and firewall (securityaffairs.com).
- Authentication is bypassed with weak or known passwords, or with CVE-2021-33044 and CVE-2021-33045 in outdated firmware.
- CERT-UA indicators: unknown accounts, unauthorized configuration changes (including text overlaid on the video image, though its absence does not mean the device is safe, per securityaffairs.com), and audit log entries showing DVRIP authentication from 127.0.0.1, a sign of P2P access.
- Hunt.io cluster 1: a Russian-speaking operator compromised 58 devices in Ukraine using the Ingram webcam scanner and CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-33044/33045 and CVE-2021-36260. The same actor also exploited TP-Link and MikroTik devices with CVE-2024-53375 and CVE-2024-57049 across 15 European countries.
- Hunt.io cluster 2, Operation CameraSwarm: a lone actor compromised over 14,530 Dahua cameras between June 17 and July 22, 2026. It scanned TCP port 37777, collected serial numbers and used brute force or the CVE-2021-33044/33045 chain. It planted a persistent backdoor account (p2pwn / p2password) on 1,923 cameras, which survives password changes and, on most firmware, factory resets. 283 cameras were reached by serial number alone through Dahua's cloud relay.
- A July 2026 Dutch intelligence bulletin said Russian actors run image recognition on camera feeds to find military vehicles, transport routes, weapon deliveries and the locations of Ukrainian personnel.
Remediação
- Disable P2P functionality if it is not required.
- Do not expose cameras and DVRs directly to the internet. For remote access, use a VPN and allow only authorized IP addresses (securityaffairs.com).
- Keep firmware up to date to close the CVE-2021-33044/33045 bypasses. Update manually and set up a regular update routine (securityaffairs.com).
- Hunt for unknown accounts, unauthorized configuration changes and DVRIP logins from 127.0.0.1.
- Check which cloud accounts are linked to each device and disconnect unknown ones. Audit all Dahua devices on the network, including forgotten ones, and report signs of unauthorized access to CERT-UA (securityaffairs.com).
Linha do tempo
-
CERT-UA warns of Dahua camera and DVR takeovers in Ukraine via Easy4IP cloud access
SecurityAffairs dates the CERT-UA alert to October 23, 2026. It adds that overlaid text on the video image can indicate tampering, but its absence proves nothing. It also adds remediation steps: check and unlink unknown cloud accounts, use a VPN with an IP allowlist, audit forgotten Dahua devices, and report incidents to CERT-UA.
ler a análise desta fonte ocultar
SecurityAffairs dates the CERT-UA alert to October 23, 2026. It adds that overlaid text on the video image can indicate tampering, but its absence proves nothing. It also adds remediation steps: check and unlink unknown cloud accounts, use a VPN with an IP allowlist, audit forgotten Dahua devices, and report incidents to CERT-UA.
CERT-UA issued an alert dated October 23, 2026 warning of unauthorized remote access to Dahua IP cameras and video recorders. The attackers watched live video, changed device settings and created their own accounts. The alert does not say who was targeted or how many devices are affected, and it names no actor. The main vector is Easy4IP, Dahua's P2P/cloud feature, which can expose devices that have no open port or public IP address.
Technical Details
- With Easy4IP enabled, the device opens an outbound connection to Dahua's cloud and registers by serial number. Access is then established through the cloud, bypassing NAT and the firewall.
- Serial numbers follow predictable patterns, so attackers can guess them automatically and check which devices are registered. Keeping a serial number private is not enough.
- Attackers then get past the login with common or weak passwords, or with CVE-2021-33044 and CVE-2021-33045 in outdated firmware. These two flaws bypass authentication without a password.
- Signs of compromise: unrecognized accounts, changed settings (including text added over the video image, though its absence does not mean the device is safe), and audit-log entries showing DVRIP logins from 127.0.0.1, which indicate cloud-relayed access.
Remediation
- Turn off P2P and cloud access if it is not used.
- Keep cameras off the internet. Use a VPN for remote access and allow only authorized IP addresses.
- Review the account list for accounts you did not create. Check which cloud accounts are linked to each device and disconnect unknown ones.
- Update firmware manually to the latest version and set up a regular update routine.
- Check all Dahua devices on the network, including forgotten ones. Report signs of unauthorized access to CERT-UA.
-
CERT-UA warns of Dahua IP camera and DVR hijacking in Ukraine via Easy4IP P2P abuse and auth bypass flaws
ler a análise desta fonte ocultar
CERT-UA and SSSCIP have warned of unauthorized remote access to Dahua IP cameras and DVRs in Ukraine, including access to video streams, configuration changes and creation of third-party accounts. The main initial access vector is the Easy4IP P2P platform. Its serial numbers are predictable, so attackers can enumerate them at scale without hitting rate limits. Authentication is then bypassed with weak or known passwords or with flaws in outdated firmware. CERT-UA did not disclose the victims, timing, number of devices or the responsible actor. The activity resembles two clusters previously reported by Hunt.io, including Operation CameraSwarm, which compromised more than 14,530 Dahua cameras. Dutch intelligence also warned in July 2026 that Russian actors use compromised IP cameras for military espionage.
Technical Details
- Easy4IP serial numbers consist of a 10-character model prefix shared by a device family and a five-character hexadecimal counter incremented almost sequentially (e.g. 7K01F36PCA003E8). This allows brute-force enumeration to find cloud-connected devices, so all devices with P2P enabled are at risk even if not directly internet-exposed.
- Authentication is bypassed with weak or known passwords, or with CVE-2021-33044 and CVE-2021-33045 in outdated firmware.
- CERT-UA indicators: unknown accounts, unauthorized configuration changes, and audit log entries showing DVRIP authentication from 127.0.0.1, a sign of P2P access.
- Hunt.io cluster 1: a Russian-speaking operator compromised 58 devices in Ukraine using the Ingram webcam scanner and CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-33044/33045 and CVE-2021-36260. The same actor also exploited TP-Link and MikroTik devices with CVE-2024-53375 and CVE-2024-57049 across 15 European countries.
- Hunt.io cluster 2, Operation CameraSwarm: a lone actor compromised over 14,530 Dahua cameras between June 17 and July 22, 2026. It scanned TCP port 37777, collected serial numbers and used brute force or the CVE-2021-33044/33045 chain. It planted a persistent backdoor account (p2pwn / p2password) on 1,923 cameras, which survives password changes and, on most firmware, factory resets. 283 cameras were reached by serial number alone through Dahua's cloud relay.
- A July 2026 Dutch intelligence bulletin said Russian actors run image recognition on camera feeds to find military vehicles, transport routes, weapon deliveries and the locations of Ukrainian personnel.
Remediation
- Disable P2P functionality if it is not required.
- Do not expose cameras and DVRs directly to the internet.
- Keep firmware up to date to close the CVE-2021-33044/33045 bypasses.
- Hunt for unknown accounts, unauthorized configuration changes and DVRIP logins from 127.0.0.1.