A security camera you never exposed to the internet can still be reachable from it. That is the main point of a warning Ukraine's national computer emergency response team, CERT-UA, issued late last week, published through the State Special Communications Service of Ukraine (SSSCIP). The agency said attackers have been compromising Dahua IP cameras and digital video recorders (DVRs) in the country. They got into video streams, changed device settings and created accounts the owners did not set up.

According to The Hacker News, the alert says "cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded." The Record reports that CERT-UA did not say how many devices were affected, when the intrusions took place, or who was behind them. This article does not attribute the activity to anyone, because none of the sources do.

The door nobody thinks about: cloud P2P

Most advice about cameras comes down to keeping them off the open internet: don't forward ports and don't give them public IP addresses. CERT-UA's warning shows where that advice falls short. The attacks appear to go through Easy4IP, Dahua's cloud remote-access service. Easy4IP is a peer-to-peer (P2P) feature, so the device connects out to Dahua's cloud and the owner's phone app or web browser reaches the camera through that cloud service. Nobody has to open a port on the router.

That is convenient, and it also means a firewall does not protect the device the way its owner assumes. The Record explains that Easy4IP connects devices to the cloud using their serial numbers, even when the devices are protected by firewalls or cannot be reached directly over the internet. In CERT-UA's words, as quoted by The Hacker News, "the assumption that the serial number is unknown to anyone is not a reason to consider the device secure."

Why the serial numbers matter

Serial numbers would be a weak but workable identifier if they were hard to guess. CERT-UA says Dahua's are not. As The Hacker News summarizes the alert, each serial has two parts. The first is a 10-character model prefix that is identical for all units of the same device family. The second is a five-character hexadecimal counter that is incremented almost sequentially.

Five hex characters allow about a million possible values per model prefix (16 to the fifth power is 1,048,576), and because the counter runs nearly in order, a search of that space is tractable. CERT-UA said the structure lets attackers guess serials at scale by brute force and check whether each one is connected to the cloud, without hitting rate limits or lockouts. The Record puts it simply: the serials follow predictable patterns, so large numbers of them can be guessed. As a result, devices with remote access enabled could be vulnerable even if their serial numbers have never been publicly disclosed.

Finding a device is not the same as getting into it. According to CERT-UA, the attackers then got past authentication using weak or known passwords, or by exploiting authentication bypass flaws in outdated firmware.

Two old bugs, still scored 9.8

The two flaws named in the reporting are CVE-2021-33044 and CVE-2021-33045. The National Vulnerability Database record for CVE-2021-33044 was published on September 15, 2021, and the CVE was assigned by Dahua itself. It describes an identity authentication bypass in some Dahua products during login: an attacker can bypass device identity authentication by constructing malicious data packets. NVD gives it a CVSS 3.1 base score of 9.8 out of 10. CVE-2021-33045 carries the same description and the same 9.8 score in NVD.

Both bugs were disclosed five years ago, yet CERT-UA still points to them in firmware that was never updated. Surveillance hardware is often installed once and left alone, so a DVR in a utility closet can plausibly run its original firmware for years.

What CERT-UA says to look for

CERT-UA listed several signs of compromise, as reported by The Hacker News:

  • Unknown accounts on the camera or recorder.
  • Configuration changes that nobody authorized.
  • Audit-log entries showing authentication over DVRIP from 127.0.0.1. DVRIP is Dahua's native device protocol, and 127.0.0.1 is the device's own loopback address. According to the alert, that combination is a sign of P2P access.

The loopback detail is worth passing on to whoever reviews your logs. An administrator who sees 127.0.0.1 might read it as harmless internal activity, when in this case it can point to the P2P path the attackers used.

The summer campaign that looks the same

CERT-UA's alert follows research the threat-intelligence firm Hunt.io published on August 18 under the name Operation CameraSwarm. Hunt.io reported that a single operator compromised more than 14,530 Dahua cameras in 35 days, from June 17 to July 22, 2026. The confirmed, geolocated compromises were concentrated in Ukraine and Russia, with Ukraine holding the largest share.

Some of Hunt.io's findings are especially relevant to defenders:

  • 1,923 cameras carried a persistent backdoor account. Hunt.io said it is stored independently of the admin password and survives a password change and, on most firmware, a factory reset.
  • 283 cameras were reached by serial number alone through Dahua's cloud relay, in most cases with no credentials.
  • The operator's own code recorded that 89.4% of live serials it probed returned an open channel requiring no authentication.

Hunt.io said the relevant national CERTs were notified on August 10, 2026. Dahua's product security team (PSIRT) was notified as well and reviewed parts of the research. The Hacker News reports that the CameraSwarm operator used credential brute-force attacks and the CVE-2021-33044/CVE-2021-33045 chain.

Are the two the same activity? That has not been established. Hunt.io told The Record that the methods CERT-UA describes closely match those used in the earlier campaign, but there is no evidence linking the attacks to the same hackers. CERT-UA has not connected its cases to CameraSwarm and has not named a culprit, so for now the overlap should be treated as a strong resemblance and not a confirmed link.

What It Means for Defenders

Who is affected: Organizations and individuals running Dahua IP cameras or DVRs. According to CERT-UA, all devices with active P2P functionality are at risk, even if they cannot be reached directly over the internet. Devices using default or weak passwords, and devices on outdated firmware vulnerable to CVE-2021-33044 and CVE-2021-33045, face the added risk of a successful login. Keeping the camera off the public internet does not protect it if P2P is enabled. The attacks CERT-UA reported were in Ukraine, but nothing in the reporting suggests the technique depends on geography.

What to do, based on CERT-UA's guidance, the sources above and general practice:

  • Turn off P2P/Easy4IP unless you actually use it. This is the first measure CERT-UA advises. If you need remote viewing, consider reaching the devices through a VPN you control and not through the vendor's cloud relay.
  • Update the firmware. CVE-2021-33044 and CVE-2021-33045 are authentication bypasses rated 9.8 and were disclosed in 2021. Check Dahua's advisories for your specific models and install current firmware. Any device that can no longer get updates should be scheduled for replacement.
  • Change default and weak passwords on every camera and recorder, and use a different strong password on each one.
  • Review accounts. Delete any user you don't recognize. Because Hunt.io found a backdoor account that survived password changes and, on most firmware, factory resets, don't count on a reset alone to clean a device that may be compromised. Hunt.io also told The Record that removing malicious accounts is not enough without a firmware update. Check the account list again afterward.
  • Read the audit logs for configuration changes nobody approved and for DVRIP logins from 127.0.0.1.
  • Don't expose devices directly to the internet, and put cameras on their own network segment so a compromised camera can't reach anything else.

For federal contractors working through CMMC, cameras are easy to overlook in asset inventories even though they record the spaces where sensitive work happens. A camera that someone else can watch through, or reconfigure, is a physical-security problem as much as a network one. Add these devices to your inventory, patching schedule and account reviews alongside your laptops and servers.

Sources