Your Security Camera Does Not Need to Be on the Internet to Be Hijacked: How Attackers Are Reaching Dahua Cameras Through the Cloud
Ukraine’s CERT-UA warns that attackers are taking over Dahua cameras and video recorders through the Easy4IP peer-to-peer service by guessing predictable serial numbers. Here is the attack step by step, the signs to look for and the settings that close the gap.
Many small businesses assume a camera behind the office firewall is safe because nobody can reach it from outside. A new warning from Ukraine’s Computer Emergency Response Team (CERT-UA) shows why that assumption fails when the camera’s cloud remote-viewing feature is switched on.
The details here come from The Hacker News’ write-up of the CERT-UA alert and The Record’s report on the same warning.
The attack, step by step
- The feature: Easy4IP is Dahua’s peer-to-peer (P2P) service. It lets owners view IP cameras, NVRs and DVRs from a phone app or browser by scanning a QR code or typing the device serial number, even when the device sits behind a firewall.
- The guessable key: CERT-UA says the serial numbers follow a predictable pattern: a 10-character model prefix shared by every unit in a device family, followed by a five-character hexadecimal counter that rises almost in sequence.
- The search: Attackers can guess serial numbers at scale and check which ones are connected to the cloud, without running into rate limits or lockouts. Any device with P2P turned on is exposed, even if it is not directly reachable from the internet.
- The login: Once a device is found, attackers get in with weak or known passwords, or by exploiting authentication bypass flaws in outdated firmware, such as CVE-2021-33044 and CVE-2021-33045, disclosed in 2021.
- The takeover: CERT-UA has recorded cases of attackers watching video streams, changing device settings and creating their own accounts.
As CERT-UA put it, assuming nobody knows a device’s serial number is not a reason to consider it secure.
Signs a device has been tampered with
- User accounts on the camera or recorder that nobody on your team created.
- Configuration changes nobody authorized.
- Audit log entries showing logins over Dahua’s own DVRIP protocol from the local address 127.0.0.1, which CERT-UA says points to P2P access.
The bigger picture
CERT-UA has not said who was targeted, when, how many devices were hit or who is behind it. The warning resembles earlier research from Hunt.io. In a campaign it called Operation CameraSwarm, a lone actor is believed to have compromised more than 14,530 Dahua cameras between June 17 and July 22, 2026, by scanning for Dahua’s default management port, TCP 37777, then using password guessing or the same two flaws. Hunt.io found a persistent backdoor account on 1,923 of those cameras. It is stored separately from the admin password, so it survives a password change and, on most firmware, a factory reset. Another 283 cameras were reached through Dahua’s cloud relay using only their serial numbers. Hunt.io told The Record the methods closely match, but it is not clear whether the two sets of incidents are connected.
Hardening spec sheet for cameras and recorders
- P2P / cloud viewing: Off unless you truly need it. If you need remote viewing, prefer a VPN into the office.
- Internet exposure: None. Do not forward ports such as 37777, web or RTSP ports to cameras or recorders.
- Firmware: Current. Anything vulnerable to CVE-2021-33044 or CVE-2021-33045 is years behind.
- Passwords: Unique and long on every device, with default accounts changed or disabled.
- Accounts: Audited. Remove any you do not recognize, and if you find one, treat the device as compromised.
- Network: Cameras and recorders on their own segment, with no route to business systems.
- Logs: Reviewed for the DVRIP-from-127.0.0.1 pattern and unexpected changes.
What this means for your company
Cameras, recorders and other connected devices tend to be installed once and then forgotten, which makes them easy targets. Cloud-based remote viewing is convenient, but it creates a path in that does not depend on your firewall. Inventory every camera and recorder, turn off remote features you do not use, keep firmware current and give these devices their own network. If a device shows signs of tampering, a password change may not be enough. Hunt.io’s findings show some backdoors survive it, so replacing or professionally reflashing the device may be the safer choice. The same steps apply to any brand of camera or recorder.
Need help inventorying and locking down the cameras and connected devices on your network? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
