攻擊者透過 Easy4IP P2P 中繼及可推算序號入侵烏克蘭 Dahua 攝影機

TL;DR

what: CERT-UA reports that attackers are guessing predictable Dahua serial numbers to reach IP cameras, NVRs and DVRs through the Easy4IP P2P cloud relay, then logging in with weak passwords or the CVE-2021-33044 and CVE-2021-33045 authentication bypasses.
impact: Attackers have watched live video, changed device settings and created rogue accounts, and a related Hunt.io campaign compromised over 14,530 Dahua cameras and backdoored 1,923 of them.
fix: CERT-UA advises disabling P2P where it is not needed, keeping devices off the direct internet and running current Dahua firmware that addresses CVE-2021-33044 and CVE-2021-33045.
who: Any organization running Dahua cameras, NVRs or DVRs with P2P turned on, including devices behind NAT, and especially sites in Ukraine and NATO states that watch logistics, transport or military movement.

Attackers are taking over Dahua IP cameras, NVRs and DVRs in Ukraine without needing a routable IP address. CERT-UA, part of the State Special Communications Service of Ukraine (SSSCIP), issued an alert last week covering compromised devices where intruders watched live video streams, changed device configuration and created their own accounts. They get in through Easy4IP, Dahua's peer-to-peer cloud platform, and it works because Dahua serial numbers can be guessed.

The risk reaches well beyond Ukraine. With P2P relay access, a camera behind NAT, with no forwarded port and no public exposure, can still be reached from the internet. The perimeter controls organizations use to keep surveillance gear private stop mattering once the device connects out to a vendor cloud and accepts sessions brokered through it.

How Easy4IP Becomes an Attack Surface

Easy4IP lets users pair Dahua cameras, NVRs and DVRs with a smartphone app or web browser by scanning a QR code or typing in the hardware Serial Number (SN). In practice, the SN is the address the cloud relay uses to find a device. CERT-UA says the serial format is predictable: a 10-character model prefix shared by every unit in a device family, followed by a five-character hexadecimal counter that increases almost sequentially. The agency gave 7K01F36PCA003E8 as an example.

A five-character hex counter allows 1,048,576 values per model prefix. Because units are numbered nearly in order, real devices sit close together in that range, which shrinks the search further. CERT-UA reports that attackers can brute-force serials at scale and check whether each one is connected to the cloud without hitting rate limits or lockouts. Any device with P2P turned on can therefore be found, whether or not it is reachable directly from the internet.

⚠️ A serial number is not a credential — CERT-UA put it plainly: "The assumption that the serial number is unknown to anyone is not a reason to consider the device secure." The serial format makes the whole range easy to enumerate, and the Easy4IP relay confirms which guesses match devices that are online.

Getting Past Authentication

Finding a live serial gets the attacker to the login prompt. CERT-UA says attackers then get past authentication with weak or known passwords, or by exploiting bypass flaws in outdated firmware, specifically CVE-2021-33044 and CVE-2021-33045. Both are Dahua authentication bypass vulnerabilities that allow login without a password. Their 2021 identifiers mean the exploited devices are running firmware that has not been updated in years.

Indicators of Compromise

CERT-UA published three indicators tied to this activity:

Accounts on the device that nobody recognizes
Configuration changes nobody authorized
Audit log authentication events over Dahua's native DVRIP protocol from the local address 127.0.0.1, a sign of P2P access

The loopback indicator is the most useful of the three. The device sees sessions brokered by the cloud relay as local connections. A DVRIP login from 127.0.0.1 on a camera that no one has handled on site points strongly to relay access.

What CERT-UA did not disclose — The alert does not say who was targeted, when the compromises happened, how many devices were affected or who is behind the activity. The figures below come from separate Hunt.io research that overlaps with CERT-UA's findings.

Two Hunt.io Campaigns Show the Scale

CERT-UA's findings overlap with two clusters of activity Hunt.io documented against cameras in Ukraine and Russia.

The first, attributed to a Russian-speaking operator, targeted internet-exposed cameras in Ukraine and compromised 58 devices. The operator used Ingram, a publicly available webcam vulnerability scanner, to exploit these flaws:

CVE-2017-7921: Hikvision authentication bypass
CVE-2020-25078: D-Link credential disclosure
CVE-2020-25169: Reolink unauthenticated information disclosure
CVE-2021-33044 and CVE-2021-33045: Dahua authentication bypasses allowing passwordless login
CVE-2021-36260: Hikvision unauthenticated remote code execution

The same actor also scanned and exploited TP-Link and MikroTik routers and cameras using CVE-2024-53375 and CVE-2024-57049 across 15 European countries: Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K. and Austria.

The second, Operation CameraSwarm, is attributed to a single actor and compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026. The chain scanned for TCP port 37777, Dahua's default proprietary management and video streaming port, collected serial numbers and then broke in with either credential brute-forcing or the CVE-2021-33044 and CVE-2021-33045 bypass chain. Hunt.io reported that "1,923 cameras carry a persistent backdoor account (p2pwn / p2password), installed over RPC after either bypass. It is stored independently of the admin password and survives a password change and, on most firmware, a factory reset. 283 cameras were reached by serial number alone through Dahua's cloud relay, with no device address and, in most cases, no credentials."

Why Camera Access Is Military Intelligence

In a July 2026 bulletin, Dutch intelligence agencies warned that Russian actors are compromising IP cameras across the E.U., NATO states and Ukraine for systematic espionage. "This actor performs automated analysis of imagery through image recognition software to conduct targeted searches for military vehicles and the military cargo they are transporting," the bulletin said. The agencies added that the footage reveals E.U. and NATO transport routes, weapon deliveries to Ukraine and the locations of Ukrainian personnel, and that it is used in attempts to neutralize those personnel and destroy their equipment.

For operators of ports, rail yards, logistics hubs, utilities and any site along a transport corridor, a compromised camera becomes a collection sensor for a foreign service. Footage of gates, loading docks and access roads shows schedules, volumes and security posture.

Vendor and CERT-UA Mitigation

CERT-UA advises disabling the P2P feature where it is not required, not exposing devices directly to the internet and keeping firmware current. Dahua firmware is the vendor fix for CVE-2021-33044 and CVE-2021-33045. The source does not list specific fixed versions, so the right build depends on Dahua's guidance for each model. Hunt.io's findings point to a gap: because the p2pwn account survives password changes and, on most firmware, factory resets, changing passwords alone will not remove an attacker who has already installed it.

RedEye Analysis

Video surveillance often belongs to facilities teams rather than security, so it falls outside patch cycles, asset inventories and log collection. This campaign takes advantage of that gap. The attack needs no exposed port and no zero-day, only a guessable identifier, a cloud relay with no lockout and firmware that is five years behind. Organizations that treat cameras as building equipment instead of networked OT assets will not see a loopback DVRIP login or a rogue account until someone else is already watching the feed.

Originally published on RedEye Threat Intelligence.