# Dahua IP Cameras Compromised in Ukraine Due to P2P Vulnerabilities

*Published October 28, 2026*
*Source: [https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html](https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html)*

## Executive Summary

CERT-UA has reported unauthorized access to Dahua IP cameras and DVRs, using vulnerabilities in the Easy4IP platform and weak security practices. The attacks highlight significant risks to digital surveillance systems, emphasizing the need for enhanced security measures.

## Article

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert about unauthorized access to Dahua IP cameras and DVRs. Attackers have been able to exploit these devices to access video streams, alter configurations, and create unauthorized accounts. The primary method of attack involves exploiting vulnerabilities in the Easy4IP platform, a peer-to-peer (P2P) system that enables remote monitoring. The serial numbers of these devices have a predictable structure, allowing attackers to perform brute-force attacks without triggering security measures. This makes all devices with active P2P functionality susceptible to these breaches, even if they are not directly accessible via the internet. 

Security is further compromised by the use of weak or known passwords and outdated firmware that contains known vulnerabilities like CVE-2021-33044 and CVE-2021-33045. CERT-UA advises disabling the P2P feature if not needed, avoiding direct internet exposure, and ensuring software is up-to-date to mitigate these risks. While the agency has not disclosed specific details about the targets or the timeline of the attacks, similarities have been observed with other campaigns targeting IP cameras in Ukraine and Russia. One such campaign by a Russian-speaking operator compromised 58 devices by exploiting known vulnerabilities in Dahua and Hikvision cameras.

Another campaign, dubbed Operation CameraSwarm, compromised over 14,530 Dahua cameras through brute-force attacks and exploits of the CVE-2021-33044 and CVE-2021-33045 vulnerabilities. This operation involved scanning for Dahua's default management port, collecting serial numbers, and deploying persistent backdoor accounts that survive password changes and factory resets. Some devices were accessed using only their serial numbers via Dahua's cloud relay. This breach highlights the ongoing risk of digital espionage, as Dutch intelligence agencies have warned about Russian actors using compromised IP cameras for military surveillance across Europe and NATO states.