CERT-UA warns of Dahua camera takeovers via cloud access
CERT-UA says attackers are hijacking internet-facing Dahua cameras through the Easy4IP cloud service, creating hidden accounts that survive password resets. Fix is a firmware update, not a reset.
CERT-UA is warning that attackers are gaining unauthorized access to internet-connected Dahua cameras and video recorders, changing their settings and creating rogue user accounts. Ukraine's State Service of Special Communications published the notice; The Record reported it. CERT-UA did not give a device count or name an actor.
How the access works
The entry point is Dahua's Easy4IP cloud remote-access feature. Because the P2P cloud connection keys off device serial numbers, which follow predictable patterns, attackers can enumerate large numbers of them to find reachable cameras, then try default or weak passwords — or exploit firmware authentication-bypass flaws. The two referenced bugs, CVE-2021-33044 and CVE-2021-33045, are from 2021; the NVD scores each 9.8, while Dahua's own advisory rates them 8.1.
Exploitation status
Threat-intel firm Hunt.io ties the activity to the campaign it documented in August as Operation CameraSwarm — roughly 14,530 devices compromised between June 17 and July 22, concentrated in Ukraine and Russia. Hunt.io attributes it to no one; it says the methods match but has no evidence the same operators are behind the current wave. Three paths were observed: credential brute-forcing against Easy4IP on TCP 37777, the 2021 auth-bypass chain, and P2P relay abuse via serial enumeration.
The persistence is the dangerous part. Hunt.io found a hidden account named p2pwn on about 1,923 cameras that survives password changes and, on most firmware, factory resets. Removing the account is not enough on its own — the fix is a firmware update.
Action checklist
- Update Dahua firmware now. That is the only step that closes the 2021 auth-bypass flaws and clears persistence a reset won't.
- Audit every camera and NVR for unexpected accounts, specifically
p2pwn, and for altered configurations. - Disable Easy4IP / P2P cloud access if you don't use it, and block TCP 37777 from the internet.
- Replace default and weak credentials, and keep management interfaces off public IPs entirely.
What other outlets missed
Hunt.io flagged that some CVE labels baked into the attacker tooling were wrong: references to CVE-2024-39943 and CVE-2025-31702 appeared in the kit but were not actually exploited in the observed attacks. And the oft-quoted figure that 89.4% of enumerated serials needed no authentication comes from the attackers' own logs — it has not been independently verified. Treat the mechanism as confirmed and the self-reported hit rate as a claim.