Ukraine’s cybersecurity authority is raising alarms over widespread unauthorized access to Dahua IP cameras and DVRs, revealing that attackers are exploiting flaws in peer-to-peer (P2P) access and weak authentication to gain remote control over surveillance systems. Targets include devices whose streams are intercepted, settings altered, and hidden user accounts created. The advisory, issued by the State Special Communications Service in partnership with CERT-UA, highlights multiple attack vectors and urges immediate mitigation steps.
How the Attack Works
The primary access point in these attacks is Dahua’s Easy4IP platform, a P2P-based system designed to let users monitor devices remotely using just a serial number or QR code. It turns out the serial numbers follow readily guessed patterns—a fixed ten-character model prefix plus a sequential hexadecimal counter—making large-scale enumeration feasible. This means even devices kept well behind firewalls or offsite may be exposed if P2P is active.
Once attackers have identified connected devices, they rely on weak or known credentials or exploit two earlier vulnerabilities in Dahua’s firmware—catalogued as CVE-2021-33044 and CVE-2021-33045—that allow login bypasses without proper credentials. With sufficient weakness, they can also install backdoor accounts that persist through password resets and often survive factory resets, giving near-permanent access.
Scale & Parallel Campaigns
While the recent alert in Ukraine hasn’t disclosed total infected numbers, separate research by cybersecurity firm Hunt.io describes a campaign dubbed “Operation CameraSwarm” that compromised more than 14,500 Dahua-style devices between mid-June and late July 2026. Most of those were located in Ukraine and neighboring countries.
Hunt.io’s findings show that about 12,300 devices were compromised through standard credential-based attacks, nearly 2,000 via authentication bypass exploits, and hundreds more accessed purely through P2P-style relay abuse—i.e., through serial numbers alone without needing direct network access or valid login credentials. A dedicated backdoor account, “p2pwn”, was deployed across almost 2,000 devices and persists even after firmware resets in many cases.
Recommendations & Known Fixes
The vulnerabilities CVE-2021-33044 and CVE-2021-33045 have been publicly known since 2021. Updated firmware addressing them was released by Dahua, though many devices appear unpatched still. Disabling the P2P functionality where not strictly needed is strongly advised. Owners should also ensure port 37777—the dedicated Dahua management/video streaming port—is not exposed to the public internet.
Other suggested defenses include auditing user accounts for unexpected entries (especially “p2pwn”), rotating any credentials that may have been stored by compromised cameras, and updating firmware to the latest vendor-approved version. These actions are not simply preventative—some of the backdoor functionality and recovery codes are only rendered safe by firmware updates.
Ukraine’s advisory offers a warning that is relevant everywhere: if your Dahua device has remote access enabled via P2P, even if its serial number has never leaked, it may already be at risk. The flaws in authentication and oversight let attackers breach video streams, persist across resets, and build access that’s difficult to erase. As IP video surveillance continues to grow, these incidents underscore the urgent need for manufacturers to enforce stronger default credentials, eliminate guessable identifiers, and ensure secure firmware update channels. What to watch next: how broadly these flaws have been exploited beyond Ukraine, and whether Dahua follows through in phasing out vulnerable models entirely.
