Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP
Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP
October 27, 2026 
Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.
Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.
The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.
As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.
“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”
Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.
Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.
There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.
CERT-UA recommends four steps:
- Turn off P2P and cloud access if you don’t use it.
- Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
- Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
- Update the software by hand to the latest version, and set up a regular update routine.
CERT-UA advises organizations that detect signs of unauthorized access to report them to [email protected] and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, IP cameras)
About Author
