Security News · thehackernews.com

CERT-UA Warns of Dahua Camera Access via P2P Serial-Number Guessing and Authentication Weaknesses

Oct 27, 2026 · Original article ↗

Summary

CERT-UA warned of unauthorized access to Dahua cameras through Easy4IP P2P, predictable serial numbers and weak authentication or outdated firmware. The alert did not disclose the affected devices, timeframe or responsible actor.

Key points

CERT-UA reported cases involving access to Dahua camera video streams, device configuration changes and creation of third-party accounts.
Attackers can reportedly guess predictable Dahua serial numbers at scale and identify devices connected to the cloud, even when they are not directly internet-accessible.
Weak or known passwords and authentication-bypass flaws in outdated firmware, including CVE-2021-33044 and CVE-2021-33045, can defeat authentication barriers.
CERT-UA did not disclose the targets, timing, number of affected devices or responsible actor; it advised disabling P2P when unnecessary, avoiding direct internet exposure and updating software.
Separately, Hunt.io attributed Operation CameraSwarm to an actor who allegedly compromised more than 14,530 Dahua cameras between June 17 and July 22, 2026, using brute force and the CVE-2021-33044/CVE-2021-33045 chain.
Hunt.io said a persistent account, “p2pwn / p2password,” was installed on 1,923 cameras and could survive password changes and, on most firmware, factory resets.

Article Details

Event Type: Unauthorized remote access and compromise of Dahua video-surveillance devices through P2P serial-number brute force and authentication weaknesses, including firmware vulnerabilities.
Impact: CERT-UA reported access to video streams, device configuration changes, and creation of third-party accounts, but did not disclose the targets, incident timing, number of affected devices, or responsible party. Separately, Hunt.io attributed a campaign to a lone threat actor and reported more than 14,530 compromised Dahua cameras and persistent backdoor accounts on nearly 2,000 cameras. The article also describes a separate campaign that compromised 58 devices. Dutch intelligence agencies reported that Russian actors use camera imagery for military intelligence, including information on transport routes, weapons deliveries, and personnel locations.

MITRE ATT&CK

T1098 · Account ManipulationAttackers reportedly created third-party accounts on compromised devices and installed persistent backdoor accounts.T1110.001 · Password GuessingCredential brute-force attacks were reported against cameras in the Operation CameraSwarm campaign.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of authentication-bypass vulnerabilities in outdated firmware on internet-exposed cameras and devices.T1595.002 · Vulnerability ScanningThe article describes scanning internet-exposed cameras and routers for vulnerabilities.

CVE

CVE-2021-33044or by exploiting authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA has shared the following indicators of compromise associated with the CVE-2021-33045authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA has shared the following indicators of compromise associated with the activity -CVE-2024-53375scanning and exploitation of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova,CVE-2024-57049of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia,

Vendors

DahuaThe Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.Hikvisionto a Russian-speaking operator, singled out internet-exposed cameras in Ukraine using known Dahua and Hikvision vulnerabilities, ultimately compromising 58 devices. The activity involved the exploitation of the MikroTikIn parallel, the threat actor is also said to have undertaken scanning and exploitation of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European TP-LinkIn parallel, the threat actor is also said to have undertaken scanning and exploitation of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European

Products

Easy4IPThe primary initial access vector used in the attacks is via Easy4IP, a peer-to-peer (P2P) platform that allows users to remotely monitor homes or small businesses by connecting their Dahua IP cameras, NVRs, and DVRs

Tools

Ingramcompromising 58 devices. The activity involved the exploitation of the following flaws by integrating Ingram, a publicly available webcam vulnerability scanner -

Countries

AustriaHungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.Bulgariaacross 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.Czechiaand CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.Francecountries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.GermanyEuropean countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.Hungaryand CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.ItalyPoland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.Moldovalike CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Polandvulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain,Romanialike CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K.,Russiasimilarities with two clusters of activity that Hunt.io disclosed as targeting IP cameras in Ukraine and Russia.Slovakiaacross 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.SpainPoland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.the Netherlandsincluding Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.the U.K.Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.UkraineThe Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.

Industries

Video surveillanceThe Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.

Related Articles