Ukraine’s CERT-UA has warned that attackers are exploiting predictable device identifiers, weak credentials and unpatched flaws to access Dahua cameras and DVRs through the Easy4IP platform.
Ukraine’s cyber defence authorities have warned that attackers are gaining unauthorised remote access to Dahua video surveillance systems, with evidence of compromised IP cameras and DVRs being used to view live streams, alter device settings and create new accounts. The alert, issued by the State Special Communications Service of Ukraine’s CERT-UA last week, says the activity is centred on Dahua’s Easy4IP peer-to-peer platform, which lets owners reach cameras and recorders through a mobile app or browser.
According to the agency, the risk is amplified by the way Dahua serial numbers are structured. The identifiers contain a fixed model prefix and a five-character hexadecimal counter that rises almost sequentially, making it possible for attackers to guess valid numbers in bulk and determine whether devices are connected to the cloud. That means equipment can be exposed even when it is not directly reachable from the public internet. CERT-UA stressed that obscurity alone is not a security control.
The agency said intruders have been getting past authentication by using weak or reused passwords, or by exploiting older firmware that remains vulnerable to known bypass flaws. Two of those bugs, CVE-2021-33044 and CVE-2021-33045, have long been rated critical, with security databases from NIST and vendors such as SentinelOne describing them as authentication bypass issues that can lead to unauthorised access on affected Dahua cameras. CERT-UA also listed warning signs of compromise, including unknown accounts, unexpected configuration changes and audit logs showing activity through Dahua’s native DVRIP protocol from 127.0.0.1, which can indicate P2P access.
The guidance is straightforward: disable P2P access if it is not needed, avoid exposing devices directly to the internet and keep firmware current. Those recommendations align with the wider pattern seen in recent camera-focused operations. Hunt.io previously described one campaign that targeted internet-exposed cameras in Ukraine with a mix of known Hikvision, Dahua, D-Link, Reolink and router vulnerabilities, ultimately affecting dozens of devices. Another, dubbed Operation CameraSwarm, was linked to more than 14,000 Dahua cameras and involved brute-force attacks, exploitation of the same Dahua authentication flaws and the installation of a persistent backdoor account that could survive password changes and, on most firmware, even a factory reset.
The latest warning also fits with broader concerns raised by Dutch intelligence services earlier this year. They said Russian actors were compromising IP cameras across the EU, NATO countries and Ukraine to support digital espionage, including automated image analysis for military vehicles, transport routes and equipment deliveries. That assessment underlines why surveillance systems, often treated as low-priority edge devices, are increasingly viewed as intelligence targets rather than simple infrastructure. In the current threat environment, camera security can have consequences well beyond the premises they are meant to monitor.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
