Hidden Behind NAT, Still Hijacked: Dahua Cameras Hit in Ukraine
CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.
Attackers are taking over Dahua IP cameras and video recorders in Ukraine through the vendor’s own peer-to-peer cloud service, reaching devices that were never exposed to the internet, Ukraine’s CERT-UA warns. In an alert relayed by SSSCIP, it says intruders watched video streams, changed settings and added their own accounts, The Hacker News reports. CERT-UA hasn’t named the attacker, the targets or how many devices were hit.
For defenders
How they get in: Dahua’s Easy4IP P2P service lets an app connect to a camera or recorder by serial number, even behind NAT. Serials are a 10-character model prefix plus a five-character hex counter that climbs almost sequentially, so they can be guessed at scale, and attackers can try them without rate limits or lockouts. From there they use weak or default passwords, T1110 (Brute Force), or the older Dahua authentication bypasses CVE-2021-33044 and CVE-2021-33045 on unpatched firmware, T1190 (Exploit Public-Facing Application). CVE-2021-33044 is rated CVSS 9.8, has been in CISA’s KEV catalog since August 2024, and has public exploit templates, including in Nuclei. They then add accounts, T1136.001 (Create Account: Local Account), and pull the video, T1125 (Video Capture).
Signs of compromise (per CERT-UA): accounts you didn’t create, configuration changes you didn’t make, and audit-log logins over Dahua’s DVRIP protocol from 127.0.0.1, which indicates the session came through the P2P relay.
Related activity: Hunt.io has documented a Russian-speaking operator compromising 58 cameras in Ukraine with old Hikvision, Dahua, D-Link and Reolink bugs, and a separate actor’s Operation CameraSwarm, which hit more than 14,500 Dahua cameras this summer and planted a backdoor account on about 1,900. The Dutch AIVD warned in July that Russian state actors use hijacked cameras to watch military movements. The Hacker News notes the overlap; CERT-UA hasn’t linked its alert to any of them.
What it means for you
Lots of home and shop cameras use the same “scan a QR code to view it on your phone” feature these attackers abused. You don’t have to open any ports for it to work, which is why the camera can be reachable even if you never put it on the internet. If you have a Dahua camera, or a cheaper brand built on Dahua hardware, a stranger might be able to watch what it sees.
Do this now
- If you don’t use the phone app to view your camera remotely, turn off P2P (often labelled Easy4IP or “cloud”) in the camera’s network settings.
- Update the camera and recorder firmware, and change the admin password to a long, unique one.
- Check the user list and remove any account you don’t recognize.
- Don’t forward camera ports such as 37777 on your router; use a VPN if you need remote access.
CVE at a glance
- CVSS
- 9.8 Critical (v3.1)
- EPSS
- 100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Aug 21, 2024
- Public exploit
- Yes, reported in a Nuclei template and 7 GitHub repositories
- CVSS
- 9.8 Critical (v3.1)
- EPSS
- 99.6% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Aug 21, 2024
- Public exploit
- Yes, reported in a Nuclei template and 1 GitHub repository
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.