Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
Summary: CERT-UA warned of unauthorized remote access to Dahua IP cameras and DVRs, with attackers gaining video stream access, changing device configurations, and creating third-party accounts, primarily through the Easy4IP peer-to-peer platform. The agency said serial numbers have a predictable structure - a 10-character model prefix shared across a device family plus a five-character hexadecimal counter incremented almost sequentially - allowing brute-force guessing at scale, while authentication is bypassed via weak or known passwords or outdated firmware flaws CVE-2021-33044 and CVE-2021-33045.
Why it matters: Hunt.io attributed one campaign, Operation CameraSwarm, to a lone actor who compromised over 14,530 Dahua cameras between June 17 and July 22, 2026, and installed a backdoor account (p2pwn / p2password) on 1,923 of them that survives a password change and, on most firmware, a factory reset.
Read the original at The Hacker News ↗
- Mentions
- CVE-2021-33044CVE-2021-33045CVE-2024-53375CVE-2024-57049
- Related
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Cyber Risks ·CVE-2021-33044: Dahua IP Camera Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 21, 2024