Attackers Hijack Dahua IP Cameras in Ukraine Through P2P Access and Authentication Flaws

Cybersecurity authorities in Ukraine have warned that attackers are gaining unauthorised access to Dahua IP cameras and digital video recorders (DVRs), potentially allowing them to view video feeds, modify device settings and create unauthorised accounts.

The warning from Ukraine’s Computer Emergency Response Team (CERT-UA) highlights weaknesses involving peer-to-peer (P2P) remote access, predictable device serial numbers, weak passwords and outdated firmware.

The incidents raise concerns about the security of internet-connected surveillance systems, particularly when devices are used to monitor sensitive locations.

Dahua Cameras at Risk From P2P Access Weaknesses

According to CERT-UA, attackers have exploited Dahua’s Easy4IP remote-access platform to reach surveillance devices. The service allows users to connect to compatible cameras, network video recorders (NVRs) and DVRs through a mobile application or web browser.

The connection process can use a device’s serial number or a QR code, making remote monitoring convenient. However, researchers have warned that weaknesses in how devices are identified and authenticated can create opportunities for unauthorised access.

CERT-UA said attackers had been observed accessing video streams, changing device configurations and creating additional accounts.

The agency stressed that an unknown serial number should not be treated as a security measure. Devices with P2P functionality may be exposed even when they are not directly accessible from the public internet.

Predictable Serial Numbers Increase Security Risks

Researchers have reported that some Dahua device serial numbers follow a predictable structure, with a model-specific prefix and a hexadecimal counter.

This pattern could help attackers guess valid serial numbers at scale and identify devices connected to the manufacturer’s cloud relay service.

The risk is particularly significant when serial-number discovery is not adequately protected by rate limits or other safeguards. If remote access also relies on weak authentication, an attacker may be able to reach a surveillance device without first discovering its public IP address.

The findings demonstrate why device identifiers should not be considered secrets or substitutes for authentication.

Weak Passwords and Outdated Firmware

CERT-UA identified weak or known passwords and authentication-bypass vulnerabilities in older firmware as additional potential routes to compromise.

Two vulnerabilities highlighted in the report are:

• CVE-2021-33044: An authentication-bypass vulnerability affecting certain Dahua products.
• CVE-2021-33045: Another Dahua authentication-bypass vulnerability that may affect vulnerable devices.

Depending on the affected device and firmware, these flaws can allow unauthorised access. Device owners should consult the manufacturer’s security advisories to determine whether their equipment is affected and which updates are available.

Indicators of Compromise

CERT-UA identified several signs that may indicate unauthorised access to Dahua surveillance systems.

Security administrators should investigate:

• Unknown or newly created user accounts.
• Unexpected changes to device configuration.
• Unrecognised access to camera video streams.
• Audit-log entries involving the manufacturer’s DVRIP protocol and the local address 127.0.0.1, which CERT-UA identified as a possible sign of P2P access.

These indicators should be assessed alongside other logs and device activity. A single event may not conclusively prove compromise, but unexplained changes warrant investigation.

Previous Campaigns Targeted Surveillance Cameras

The warning follows previous research documenting attacks against surveillance cameras and other network-connected devices.

Security researchers at Hunt.io described a campaign involving internet-exposed cameras in Ukraine that exploited known vulnerabilities affecting Dahua and Hikvision products. The research reported that 58 devices were compromised in one cluster of activity.

The vulnerabilities discussed in that research included CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-33044, CVE-2021-33045 and CVE-2021-36260. These affect different manufacturers and products, so administrators should verify each device’s exposure rather than assuming all listed flaws apply to Dahua equipment.

Researchers also described Operation CameraSwarm, a campaign reportedly targeting Dahua cameras between June 17 and July 22, 2026.

According to Hunt.io, the campaign compromised more than 14,530 cameras. Researchers reported that 1,923 devices had a persistent unauthorised account identified as p2pwn or p2password. The report also described cases in which attackers reached cameras through Dahua’s cloud relay using serial numbers.

These findings illustrate the potential consequences of combining weak authentication, vulnerable firmware and remote-access mechanisms.

Surveillance Cameras Could Be Used for Espionage

The security implications extend beyond the privacy of homes and businesses. Compromised surveillance systems can potentially provide information about activities, movements and locations.

In July 2026, Dutch intelligence agencies warned that Russian actors were compromising IP cameras across European Union countries, NATO states and Ukraine.

According to the advisory, automated image-recognition systems were used to search camera footage for military vehicles and transported cargo. Such information could help identify military transport routes, weapons deliveries and the locations of personnel.

Although the intelligence advisory described a broader espionage concern, it does not establish that the activity was connected to every incident reported by CERT-UA.

How to Protect Dahua IP Cameras

Organisations and individuals using Dahua cameras should review their configurations and follow the manufacturer’s current security guidance.

Recommended defensive measures include:

1. Disable P2P access if it is not required. Review Easy4IP and related remote-access settings on each device.
2. Update firmware. Install vendor-provided security updates for the exact camera, NVR or DVR model.
3. Use strong, unique passwords. Replace default or reused credentials and restrict administrative access.
4. Review user accounts. Investigate unfamiliar accounts and remove unauthorised users after preserving relevant evidence.
5. Restrict network exposure. Avoid exposing camera management interfaces directly to the internet. Use appropriately secured remote-access methods where necessary.
6. Monitor logs and configuration changes. Investigate unusual authentication events, unexpected settings changes and unexplained account creation.
7. Isolate surveillance equipment. Place cameras on a dedicated network segment and restrict unnecessary communication with other systems.
8. Investigate suspected compromise. Preserve relevant logs and contact the device vendor or a qualified incident-response team if unauthorised access is suspected.

If a persistent backdoor is suspected, changing the administrator password alone may not be sufficient. Follow vendor guidance and verify the device’s integrity before returning it to service.

Conclusion

The CERT-UA warning highlights how weaknesses in P2P access, predictable serial numbers, weak passwords and outdated firmware can put surveillance systems at risk. Previous research into camera-targeting campaigns also demonstrates how compromised devices may be used for unauthorised monitoring and intelligence gathering.

Users and organisations should review remote-access settings, update vulnerable devices, strengthen authentication and investigate suspicious accounts or configuration changes.

Securing surveillance equipment is an important part of protecting privacy, business operations and sensitive physical locations.

Source: CERT-UA / SSSCIP security alert

CyberExy – Secure Tomorrow.