CERT-UA has warned that attackers are taking control of Dahua IP cameras, NVRs and DVRs, then watching the video stream, changing device settings and adding accounts of their own. The way in is not a new bug. It is Dahua's Easy4IP peer-to-peer cloud service, combined with authentication flaws that were published five years ago.
What happened
Ukraine's national CERT issued the alert after recording compromises of cameras and recorders. The SSSCIP said attackers reached the devices through Easy4IP, the P2P platform that lets an owner view a camera from a phone app or a browser by scanning a QR code or typing the unit's serial number.
The weakness is the serial number itself. It is not random. Every device in a family shares a fixed ten-character prefix, and the rest is a five-character hexadecimal counter that climbs almost in sequence. That makes the identifiers guessable at volume, so an attacker can probe Dahua's cloud for live units without triggering lockouts or rate limits. A camera does not have to be reachable from the internet to be found this way.
Once a unit answers, the login is beaten with a weak or default password, or by replaying an authentication bypass against firmware that was never updated. CERT-UA pointed at CVE-2021-33044 and CVE-2021-33045, two identity authentication bypasses in Dahua cameras, recorders and intercoms that were published in October 2021.
Earlier research shows the scale. Hunt.io's Operation CameraSwarm recorded 14,530 Dahua cameras compromised between 17 June and 22 July 2026, and found 1,923 of them carrying an extra account, p2pwn with the password p2password, installed in a way that survives an admin password change and, on most firmware, a factory reset. A further 283 units were reached by serial number alone through Dahua's cloud relay, with no device address and in most cases no credentials at all.
Who is affected
Any Dahua camera, NVR or DVR with the P2P or Easy4IP feature switched on, which is how most retail units ship.
- Sites running Dahua or Dahua-based OEM recorders for CCTV: small retail, workshops, warehouses, farms and home setups.
- Devices on old firmware that still accept the 2021 login bypasses.
- Installations behind NAT, because the cloud relay goes around that protection instead of through it.
What to do now
Turn off P2P and Easy4IP on every Dahua device you manage, then confirm that no account exists on it that you did not create. If remote viewing is a requirement, put the recorder behind a VPN or a segmented remote-access method rather than the vendor cloud.
- Open the account list on each recorder and camera and remove any user you cannot account for.
- Change the admin password to something unique, then check the account list again, because the planted backdoor account is stored separately and will still be there.
- Update firmware to the current Dahua release, and replace units too old to receive updates.
- Review the audit log for logins over the native DVRIP protocol from 127.0.0.1, which is the signature of P2P access.
- Where a device has already been compromised, reset it and rebuild the configuration instead of cleaning it in place.
What this means for South African businesses
Dahua and Hikvision recorders are the default choice for small-site CCTV in South Africa, and most were installed with P2P switched on because that is what makes the phone app work without a VPN. That convenience is the attack path: the device sits on the vendor's cloud, where its identity is a guessable serial number rather than a firewall rule. In my judgement most SME camera estates here are exposed in exactly this way and sit outside any firmware maintenance contract, so the 2021 bypasses are still live on site.
Source: The Hacker News, citing CERT-UA and Hunt.io research.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.