Ukraine’s Computer Emergency Response Team (CERT-UA) has warned that hackers are gaining unauthorized access to Dahua video surveillance systems by abusing the manufacturer’s cloud connectivity features and exploiting weaknesses in device authentication.
The attacks have reportedly allowed intruders to access live video streams, modify device configurations and create unauthorized accounts on compromised internet protocol (IP) cameras and digital video recorders (DVRs). Ukraine’s State Special Communications Service (SSSCIP) disclosed the activity in a recent security alert.
According to CERT-UA, one primary access method involves Easy4IP, a peer-to-peer (P2P) platform that lets users remotely access Dahua cameras, network video recorders (NVRs), and DVRs through a mobile app or web browser. The service lets users connect devices using a QR code or the device’s hardware serial number.
The security concern stems partly from the structure of Dahua device serial numbers. Research cited by the Ukrainian agency indicates that these identifiers contain a model-specific prefix shared by devices in the same product family, followed by a hexadecimal counter that may increase in a predictable sequence. This structure could allow attackers to generate and test large numbers of possible serial numbers to identify devices connected to the cloud service.
As a result, cameras with P2P functionality enabled could be exposed even when they are not directly accessible from the public internet. CERT-UA warned that keeping a device’s serial number private should not be considered a reliable security measure.
Attackers may also bypass authentication by exploiting weak or previously exposed passwords, as well as vulnerabilities in outdated firmware. The agency specifically identified CVE-2021-33044 and CVE-2021-33045, two Dahua authentication bypass vulnerabilities that can allow unauthorized access under affected conditions.
CERT-UA advised administrators to look for unfamiliar user accounts, unexpected configuration changes and suspicious authentication events in device audit logs. One potential warning sign is activity involving Dahua’s proprietary DVRIP protocol that appears to originate from the local address 127.0.0.1, which the agency identified as a possible indicator of access through the P2P mechanism.
To reduce the risk, organizations and individuals should disable P2P remote access when it is not needed, avoid exposing camera management interfaces directly to the internet, install available firmware updates and use strong, unique passwords. Administrators should also review existing accounts and logs for signs of unauthorized access.
The Ukrainian agency has not disclosed the full number of affected devices, the identities of the victims or the individuals responsible for the activity. However, the warning comes amid other investigations into campaigns targeting surveillance equipment across Ukraine, Russia and Europe.
Cybersecurity company Hunt.io previously reported a campaign attributed to a Russian-speaking operator that targeted internet-accessible cameras in Ukraine. The investigation identified 58 compromised devices and documented the exploitation of known vulnerabilities affecting Dahua, Hikvision, D-Link and Reolink products. The activity also involved Ingram, a publicly available scanner designed to identify vulnerable webcam systems.
The reported attacks extended beyond surveillance cameras. Hunt.io also identified scanning and exploitation activity targeting TP-Link and MikroTik routers across 15 European countries, including Ukraine, Poland, Romania, Germany, France, Italy and the United Kingdom. The activity involved vulnerabilities including CVE-2024-53375 and CVE-2024-57049.
Another investigation, known as Operation CameraSwarm, reportedly uncovered a much larger campaign targeting Dahua cameras between June 17 and July 22, 2026. According to Hunt.io, the operation compromised more than 14,530 IP cameras through credential brute-force attacks and exploitation of CVE-2021-33044 and CVE-2021-33045.
The campaign involved scanning for TCP port 37777, Dahua’s default proprietary management and video streaming port. Attackers then collected device serial numbers and attempted to gain access using the identified vulnerabilities and authentication techniques.
Hunt.io reported that 1,923 cameras had a persistent backdoor account named “p2pwn,” associated with the password “p2password.” The researchers said the account was installed through remote procedure calls and could survive password changes and, on most affected firmware versions, a factory reset. The report also identified 283 cameras that could be reached through Dahua’s cloud relay using only their serial numbers, without knowing their network addresses and, in most cases, without supplying credentials.
These findings highlight the risks associated with cloud-connected surveillance systems when device identification mechanisms, remote access features and authentication controls can be abused. A camera does not necessarily need an exposed public IP address to be reachable through a vendor’s remote access infrastructure.
The security concerns also have potential national security implications. In July 2026, Dutch intelligence agencies warned that Russian actors were compromising IP cameras across European Union countries, NATO member states and Ukraine to collect military intelligence.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
According to the advisory, the attackers used image-recognition software to search camera footage for military vehicles and cargo. The resulting intelligence could reveal military transport routes, weapons deliveries to Ukraine and the locations of Ukrainian military personnel.
The reports demonstrate how compromised surveillance equipment can be used for more than unauthorized viewing. Depending on its location and the information it captures, a vulnerable camera could become a source of intelligence for criminal groups or state-linked operators.
