Ukraine's computer emergency response team CERT-UA published an alert on 23 October 2026 about attacks on Dahua video surveillance equipment. According to the alert, attackers gained remote access to IP cameras and video recorders, watched the live video, changed device settings and created accounts of their own. CERT-UA did not say who was targeted, when the break-ins happened, how many devices were affected or who is behind the activity.

The route in: Easy4IP

The main entry point is Easy4IP, Dahua's peer-to-peer (P2P) cloud feature for remote viewing from a phone app or a browser. With it switched on, a camera or recorder opens an outgoing connection to Dahua's cloud and registers there under its serial number. Anyone who reaches the device through the cloud does so by serial number, with no open port, no port forwarding and no public IP address. The router's NAT and firewall do not stop that traffic.

That would matter less if serial numbers were hard to guess. CERT-UA says they are not. The Hacker News, summarising the alert, describes a 10-character model prefix shared by every unit of a device family, followed by a five-character hexadecimal counter that rises almost sequentially. Attackers can try numbers in bulk and see which ones are registered in the cloud. In CERT-UA's words, the assumption that nobody knows the serial number "is not a reason to consider the device secure".

The cloud only gets an attacker to the login. From there, CERT-UA lists weak or known passwords and two old authentication bypass flaws in outdated firmware, CVE-2021-33044 and CVE-2021-33045.

Signs of compromise

CERT-UA names three indicators:

  • unknown user accounts on the device;
  • configuration changes nobody made;
  • audit log entries for logins over Dahua's own DVRIP protocol from the local address 127.0.0.1, which points to access through P2P.

What to do

The advice is short: turn off P2P if you do not need it, do not expose the devices directly to the internet, update the firmware and remove accounts you do not recognise. Earlier research by Hunt.io, cited by The Hacker News, adds a warning. In a separate campaign this summer, a backdoor account planted on almost 2,000 Dahua cameras was built to survive a password change and a factory reset. Deleting a suspicious account may therefore not be enough.

Why this matters at home

Easy4IP is the feature that makes these cameras easy to set up: scan a QR code and the stream works anywhere. The same convenience means a camera on a home or small office network can be reached without any exposed port. If you run cameras locally, for example through RTSP in Frigate or another NVR, the cloud path is often unnecessary and can be switched off.