Dahua Camera Takeover Via Easy4IP Cloud Access

Attackers are taking over Dahua IP cameras and video recorders through Easy4IP, Dahua’s cloud remote-access feature, according to a CERT-UA alert published on October 23 and reported by Security Affairs on October 27. A Dahua camera takeover does not need an open port: the device dials out to Dahua’s cloud, and from there it can be reached with nothing more than its serial number.

What Happened in the Dahua Camera Takeover

In the Dahua camera takeover that CERT-UA describes, attackers gained unauthorized remote access to IP cameras and video recorders. They watched live video, changed device settings and created accounts of their own. The alert does not say who was targeted or how many devices are affected, and the reporting we read names no actor.

The vector is Easy4IP. When the feature is on, the device opens an outgoing connection to Dahua’s cloud and registers by serial number. Access then runs through the cloud, past NAT and firewall, with no published port and no public IP address. CERT-UA’s point: having no direct internet access does not make a device with active P2P safe. Serial numbers follow predictable patterns, so attackers can guess them.

After connecting, the attacker still has to log in. That means common or weak passwords, or two old authentication bypasses, CVE-2021-33044 and CVE-2021-33045, on outdated firmware. CERT-UA names them as a route; whether they were used in the new incidents is not established. Dahua’s advisory DHCC-SA-202106-001, rated 8.1, says an attacker can bypass device authentication with crafted packets. Affected are, for example, IPC cameras with builds older than June 2021 (CVE-2021-33044) or May 2020 (CVE-2021-33045); the advisory lists fixed firmware per model.

Separately, Hunt.io reported on August 18 that a campaign it calls CameraSwarm compromised more than 14,000 Dahua cameras between June 17 and July 22, 2026, mostly in Ukraine and Russia. Those are Hunt.io’s own figures; CERT-UA’s alert does not name the campaign, so we have not confirmed a link.

Why It Matters

Cameras record people and premises, so a hijacked stream is also a data protection problem under GDPR Article 32, and unmanaged devices are the asset-management gap that NIS2 expects you to close. The authentication bypasses have had fixes since 2021, which means an affected camera is one that nobody has updated in years. Both are in CISA’s KEV catalog (added August 2024).

Assumption: mid-sized DACH companies run cameras like these at plants, warehouses and branch offices, often installed and managed by a facility or security vendor, and sometimes with cloud access switched on by default. If that is you, the camera most likely to matter is the one nobody remembers owning.

What You Should Do Now

1. List every Dahua camera and recorder, including forgotten ones and those managed by an installer. Ask whether devices sold under another brand name are Dahua-built. On each device, check the build date under Settings, System Information, Version Information.
2. Switch off P2P and cloud access (Easy4IP) if you do not use it. Keep cameras off the internet; for remote access use a VPN and allow only authorized IP addresses, as CERT-UA advises.
3. Update the firmware manually to the fixed release for your model from Dahua advisory DHCC-SA-202106-001 or newer, and set a regular update routine. Treat devices with older builds as exposed, and do not rely on a password change alone on old firmware.
4. Check for compromise: unknown user accounts, unknown cloud accounts linked to the device, changed settings including text laid over the video image, and DVRIP logins from 127.0.0.1 in the audit log. CERT-UA notes that missing overlay text does not mean a device is clean. Report findings to your CSIRT.

DIESEC Perspective

Cameras are small computers on your network that rarely get patches or an owner. Put them in their own network segment, block their outgoing cloud connections if you do not use the feature, and give each device a named owner and an update date.

Not sure which of your cameras and recorders use cloud access or still run old firmware? Contact DIESEC for an IoT exposure check and firmware review.

Sources: CERT-UA | Security Affairs | Dahua PSIRT DHCC-SA-202106-001 | Hunt.io
Published: 2026-10-30 | Category: Vulnerabilities & Patches | ~4 min read