Immediate Threat to Dahua IP Cameras
The Ukrainian Computer Emergency Response Team (CERT-UA) issued an alert on Oct 27 2026 that attackers have hijacked Dahua IP cameras, DVRs, and NVRs by exploiting the Easy4IP peer-to-peer (P2P) platform and weak authentication mechanisms. The attacks allow remote viewing, configuration changes, and creation of third-party accounts.
Dahua camera hijack via P2P discovery and credential abuse
The Easy4IP service lets users connect devices via a smartphone app or web browser by scanning a QR code or entering the device’s serial number (SN). CERT-UA noted that the SN format is predictable: a 10-character model prefix common to all units of a family followed by a 5-character hexadecimal counter that increments almost sequentially (e.g., 7K01F36PCA003E8). Attackers can brute-force this space, identify devices registered with the cloud, and gain P2P access without triggering rate limits or lockouts.
Once connected, attackers exploit weak or known passwords, or leverage authentication bypass vulnerabilities in older firmware. Two CVEs are highlighted: CVE-2021-33044 and CVE-2021-33045, both affecting authentication in outdated firmware versions. Successful exploitation results in unauthorized configuration changes, creation of new accounts, and audit logs that show authentication events from the local address 127.0.0.1, a signature of P2P activity.
Evidence and indicators of compromise
CERT-UA lists the following indicators of compromise:
- Presence of unknown user accounts on the device.
- Unauthorized configuration changes visible in the device’s settings.
- Audit logs containing authentication events via the manufacturer’s native protocol (DVRIP) originating from 127.0.0.1.
These indicators confirm that an attacker has accessed the device through the P2P channel and has bypassed authentication.
Mitigation steps
- Disable P2P if the feature is not required. This removes the remote access vector entirely.
- Do not expose devices directly to the internet. If remote access is needed, use a VPN or a dedicated secure gateway.
- Update firmware to the latest version that patches CVE-2021-33044 and CVE-2021-33045. Firmware releases after early 2022 contain the necessary fixes.
- Enforce strong, unique passwords for all device accounts. Avoid default credentials.
- Monitor audit logs for unfamiliar accounts or authentication events from 127.0.0.1.
Uncertainties and open questions
CERT-UA has not disclosed the number of infected devices, the exact dates of compromise, or the identities of the attackers. The scope of the attack remains unknown, but the technical mechanisms are clear and actionable.
Technical context
The Easy4IP P2P service is designed for convenience, but its reliance on predictable serial numbers and lack of rate limiting creates a scalable attack surface. The CVEs in question allow attackers to bypass authentication entirely, turning a device that should be protected by a password into a fully controllable endpoint.
Next steps for operators
- Verify whether your Dahua devices are using the Easy4IP service.
- Check firmware versions against the latest patch notes.
- Apply the recommended mitigations immediately.
- Consider implementing network segmentation to isolate surveillance devices.
Original analysis
The persistence of CVE-2021-33044/45 in firmware versions still in use indicates that many installations remain vulnerable even after the initial P2P discovery. The predictable serial number scheme and the absence of rate limiting mean that an attacker can scale the hijack operation across thousands of devices with minimal effort. Operators who rely on P2P for remote access should evaluate whether the convenience outweighs the risk, especially in environments where cameras are deployed in critical infrastructure or near sensitive assets. Future updates from Dahua that remove the Easy4IP service or introduce stronger authentication for P2P connections will be essential to reduce the attack surface.
Related resources
For a broader view of CVE exploitation patterns, see the Zero-Day Vulnerability & CVE Exploit Matrix.
Related coverage
- North Korea Targets Ukrainian Personnel with Reply-Bait Phishing
- Magento Stores Hit by Scanner-Evasion JavaScript Loader Campaign