Ukraine’s national cyber incident response team (CERT-UA) has warned that threat actors can get unauthorized remote access to Dahua security cameras and video recorders. Such access would allow them watch video streams, change device settings, and create unknown user accounts.
The agency said that the main attack vector is the P2P cloud access feature, known as Easy4IP. It allows devices to connect to the manufacturer’s cloud service, which can let attackers access them even when they are not directly exposed to the internet. Hackers can find devices by searching for their serial numbers and exploiting weak passwords or security flaws in outdated software.
According to CERT-UA, attackers may discover devices by automatically testing predictable serial number patterns and checking which devices are registered in the cloud. Threat actors can then exploit weak or default passwords or use authentication bypass vulnerabilities in outdated firmware, including CVE-2021-33044 and CVE-2021-33045, which may allow access without knowing the correct password.
Possible signs of compromise include unknown user accounts, unexpected configuration changes, and unusual text overlays on video footage. Audit logs may also contain authentication events using Dahua’s native DVRIP protocol and the local address 127.0.0.1, which can indicate access through the P2P service.
CERT-UA recommends disabling P2P and cloud access when they are not needed, avoiding direct internet exposure, and using a VPN with access limited to approved IP addresses. Users are also recommended to review device and cloud accounts, remove unknown accounts, and manually update firmware to the latest available versions.