Ukraine's CERT-UA Detects Unauthorized Access Incidents in Dahua Cameras and Recorders. Easy4IP, P2P Risks, and Mitigation Measures.
Ukraine's Computer Emergency Response Team (CERT-UA) has detected unauthorized access incidents targeting Dahua IP cameras and video recorders. The alert focuses on the security of cloud-based remote access and the risks posed by outdated device firmware.
Warning from Ukraine for Dahua Cameras: Unauthorized Interference via Cloud Access
Ukraine's national computer emergency response team, CERT-UA, has announced that unauthorized access has been gained to IP cameras and video recorders manufactured by Dahua. In the detected incidents, attackers reportedly changed device settings, created unauthorized user accounts, and accessed video streams.
The warning, reported by The Record on October 26, 2026, highlighted the security of devices that are not directly exposed to the internet but utilize the manufacturer's cloud access services.
Why are Easy4IP and P2P access a concern?
Dahua's Easy4IP infrastructure is a P2P-based service that allows users to remotely access cameras and recording devices. This method can eliminate the need for devices to have a directly exposed IP address on the internet or for ports to be opened on a router for incoming connections.
However, according to CERT-UA's assessment, device serial numbers following specific and predictable patterns can help attackers identify devices registered with the cloud service.
Gaining access to a device alone does not mean unauthorized access has occurred. In the next stage, attackers can attempt weak passwords or exploit vulnerabilities in older software versions.
This situation demonstrates the inadequacy of a common assumption in security cameras: A camera not being directly exposed to the internet does not mean its cloud access mechanism is also secure.
Old Vulnerabilities Still Pose a Risk
CERT-UA highlighted two vulnerabilities affecting specific Dahua cameras and recording devices:
CVE-2021-33044
CVE-2021-33045
These vulnerabilities, disclosed in 2021, can allow authentication bypass in affected devices and software versions.
Therefore, when conducting a risk assessment, it is not sufficient to look only at the device brand. The model number, hardware version, firmware used, and active remote access features should be examined together.
Over 14,000 Devices Reportedly Compromised Previously
Cybersecurity company Hunt.io, in its CameraSwarm research published on August 18, 2026, disclosed its findings regarding over 14,500 Dahua devices being compromised between June and July.
The research stated that persistent unauthorized user accounts were created on some devices, with verified incidents particularly in Ukraine and Russia.
However, it has not been confirmed that the operation investigated by Hunt.io and the incidents mentioned in CERT-UA's latest warning belong to the same attacker group.
What Should Dahua Camera Users Do?
Based on CERT-UA's warning and previous security research, it is crucial for system administrators to perform the following checks:
Review P2P and cloud access. Disable remote access features if not needed.
Check firmware versions. Verify and apply manufacturer updates appropriate for the device model.
Audit user accounts. Investigate unrecognized local or cloud-linked accounts.
Renew passwords. Especially change default, commonly used, or potentially previously compromised passwords.
Limit network access. Position cameras and recording devices on separate networks as much as possible. Consider secure VPN connections for remote management.
Examine event logs. Investigate unexpected configuration changes and unusual login activities.
CERT-UA also draws attention to specific authentication events occurring via the local 127.0.0.1 address in DVRIP session logs. This finding is among the indicators that can help investigate the possibility of P2P access; it should not be considered definitive proof of a breach on its own.
Cybersecurity in Physical Security Systems Can No Longer Be Considered Separately
The compromise of an IP camera may not only affect image privacy. Considering the device's location, field of view, and accessible areas, unauthorized monitoring and configuration changes can also impact physical security.
Therefore, especially in critical infrastructure facilities, industrial enterprises, and extensive camera networks, device lifecycle management is as important as product selection.
GüvenlikOnline's Dahua product catalog can be used to examine the brand's different device families. However, whether a current security alert affects a specific model must be independently verified from the manufacturer's technical documentation.