CERT-UA: Dahua cameras hijacked via guessable serial numbers and Easy4IP P2P relay

Ukraine's national computer emergency team is warning about an active campaign in which attackers seize control of Dahua IP cameras, NVRs and DVRs without ever needing a routable network address. According to CERT-UA, part of the State Special Communications Service, intruders reached the devices through Dahua's Easy4IP peer-to-peer cloud relay by guessing serial numbers, then signed in using weak passwords or authentication-bypass flaws disclosed in 2021. Once inside, they watched live video streams, changed device settings and created accounts of their own.

The alert, described in a dev.to write-up that also folds in related threat research, does not name victims, dates of compromise, victim counts or perpetrators. But it documents a working attack chain that applies to any Dahua device with the P2P feature switched on, including cameras hidden behind NAT with no forwarded ports and no public exposure.

How the relay finds cameras behind NAT

Easy4IP pairs cameras and recorders with a phone app or browser using a QR code or the hardware serial number. In practice, that serial is the address the cloud relay uses to locate a device. CERT-UA says the format is predictable: a ten-character model prefix shared by every unit in a device family, followed by a five-character hexadecimal counter that increments almost sequentially. The agency cited 7K01F36PCA003E8 as an example.

Five hex characters give just over a million possible values per model prefix, and because units ship numbered nearly in order, live devices cluster close together in that range. CERT-UA reports that serials can be brute-forced at scale with no rate limits or lockouts, and the relay confirms which guesses match an online device. As the agency put it, "the assumption that the serial number is unknown to anyone is not a reason to consider the device secure."

From guessable serial to passwordless login

A valid serial only gets an attacker to a login prompt. From there, CERT-UA says intruders used weak or already-known passwords, or exploited CVE-2021-33044 and CVE-2021-33045, a pair of Dahua authentication bypasses that allow login without a password. Their 2021 identifiers mean compromised devices are running firmware that has not been updated in years.

Indicators of compromise

CERT-UA published three signs of compromise: local accounts nobody recognises, configuration changes nobody authorised, and audit-log authentication events over Dahua's native DVRIP protocol originating from 127.0.0.1. The loopback indicator is the telling one. Sessions brokered through the cloud relay appear to the device as local connections, so a DVRIP login from localhost on hardware nobody touched on site points strongly to relay access.

Related campaigns show the scale

Separate Hunt.io research that overlaps with CERT-UA's findings puts numbers on the problem. One cluster, attributed to a Russian-speaking operator, compromised 58 internet-exposed cameras in Ukraine using Ingram, a publicly available webcam vulnerability scanner, against a stack of old flaws: the Hikvision bypass CVE-2017-7921, Hikvision RCE CVE-2021-36260, D-Link credential disclosure CVE-2020-25078, Reolink information disclosure CVE-2020-25169 and the two Dahua bypasses. The same actor also hit TP-Link and MikroTik gear via CVE-2024-53375 and CVE-2024-57049 across 15 European countries.

A second cluster, dubbed Operation CameraSwarm and attributed to a single actor, compromised more than 14,530 Dahua cameras between June 17 and July 22, 2026. The operation scanned TCP port 37777, Dahua's default management and streaming port, harvested serial numbers, then broke in with credential brute-forcing or the CVE-2021-33044 and CVE-2021-33045 chain. Hunt.io found 1,923 of those cameras carrying a persistent backdoor account, p2pwn with password p2password, installed over RPC and stored independently of the admin password, so it survives a password change and, on most firmware, a factory reset. A further 283 cameras were reached by serial number alone through the cloud relay, with no device address and usually no credentials at all.

The espionage payoff

A July 2026 bulletin from Dutch intelligence agencies, cited in the same write-up, warned that Russian actors are compromising IP cameras across the EU, NATO states and Ukraine for systematic espionage. According to the agencies, the actor runs automated image recognition over captured footage to search for military vehicles and the cargo they carry, revealing transport routes, weapon deliveries to Ukraine and the locations of Ukrainian personnel, and feeding efforts to target that personnel and destroy their equipment.

What CERT-UA recommends

CERT-UA advises disabling the P2P feature wherever it is not required, keeping devices off direct internet exposure, and updating to current Dahua firmware that addresses CVE-2021-33044 and CVE-2021-33045. The source does not list specific fixed versions, so the right build depends on Dahua's guidance for each model. Hunt.io's backdoor finding adds an uncomfortable caveat: rotating passwords will not evict an attacker who has already installed the p2pwn account, and on most firmware even a factory reset will not.

Why it matters

This chain needs no exposed port and no zero-day, only a guessable identifier, a cloud relay with no lockout and firmware years out of date. Devices their owners consider safely hidden behind NAT remain reachable the moment P2P is enabled, which quietly dissolves the perimeter controls most organisations rely on. Video surveillance often belongs to facilities teams rather than security teams, so it sits outside patch cycles, asset inventories and log collection. For ports, rail yards, logistics hubs and any site along a transport corridor, an unpatched camera is not building equipment. It is a collection sensor for a foreign intelligence service.