{"id":"CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b","kind":"campaign","aliases":[],"related":["CVE-2021-33044","CVE-2021-33045"],"title":"Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses","description":null,"summary":"CERT-UA (Ukraine) warned the week of 2026-10-20 about confirmed compromises of Dahua IP cameras, NVRs and DVRs: attackers view video streams, change device settings and create their own accounts. They find devices through Dahua's Easy4IP P2P cloud by brute-forcing serial numbers, which follow a predictable pattern, so devices with P2P on can be reached even when they sit behind a firewall/NAT and are not exposed to the internet. They then log in with weak or known passwords, or use old auth bypass flaws in outdated firmware (CVE-2021-33044, CVE-2021-33045). Anyone running Dahua cameras/recorders with P2P (Easy4IP) on is at risk. CERT-UA did not say which targets, how many devices, when it started or who is behind it. The pattern matches Hunt.io's Operation CameraSwarm (14,530+ Dahua cameras compromised 2026-06-17 to 2026-07-22, mostly in Ukraine and Russia), but CERT-UA has not linked the two.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T07:12:40+00:00","products":[{"name":"Dahua IP cameras","fixed":[],"affected":"devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045","ecosystem":"vendor"},{"name":"Dahua NVR/DVR","fixed":[],"affected":"devices with Easy4IP P2P enabled and weak passwords or outdated firmware","ecosystem":"vendor"},{"name":"Dahua Easy4IP","fixed":[],"affected":"P2P cloud access feature","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","dahua","early-warning","ip-camera"],"not_affected_if":[],"how_to_check":"On Dahua cameras/NVRs/DVRs: look for user accounts you did not create (CameraSwarm planted a backdoor account p2pwn / p2password that survives password changes and, on most firmware, factory reset); unexplained configuration changes; audit log entries showing authentication over the DVRIP protocol from 127.0.0.1 (sign of P2P/Easy4IP access). Check whether P2P/Easy4IP is enabled, whether TCP 37777 is reachable from the internet, and whether firmware still has CVE-2021-33044/33045.","fix":"Turn off P2P/Easy4IP on Dahua devices unless you need it. Do not expose the devices (TCP 37777, web UI) to the internet. Update firmware to versions that fix CVE-2021-33044/33045. Change default or weak passwords. Remove unknown accounts; if you find p2pwn or other rogue accounts, assume the device is compromised and reflash or replace it. Put cameras on an isolated network segment.","status":"open","published_at":null,"first_seen_at":"2026-10-27T07:12:40+00:00","triaged_at":"2026-10-27T07:12:40+00:00","updated_at":"2026-10-27T07:12:40+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-06':195B '-07':199B '-10':62B '-17':196B '-20':63B '-2021':147B,150B '-202610':23A '-22':200B '-33044':148B '-33045':151B '14':189B '2026':61B,194B,198B '530':190B 'account':85B 'and':28A 'anyon':152B 'attack':74B 'auth':20A,140B 'b':36A 'behind':118B,180B 'brute':97B 'brute-forc':96B 'bypass':21A,141B 'camera':3A,52B,70B,192B 'cameras':27A,40A 'cameras/recorders':155B 'cameraswarm':37A,188B 'campaign':45B 'cert':54B,164B,208B 'cert-ua':53B,163B,207B 'chang':78B 'cloud':11A,35A,94B 'cmp':22A 'compromis':66B,193B 'confirm':65B 'creat':82B 'cve':146B,149B 'dahua':1A,25A,38A,41A,43A,46B,68B,90B,154B,191B 'dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b':24A 'devic':79B,88B,107B,173B 'dvrs':5A,29A,73B 'earli':48B 'early-warn':47B 'easy4ip':9A,33A,44A,92B,158B 'even':114B 'expos':124B 'find':87B 'firewall/nat':120B 'firmwar':145B 'flaw':142B 'follow':102B 'forc':98B 'guess':13A 'hunt.io':185B 'internet':127B 'ip':2A,26A,39A,51B,69B 'ip-camera':50B 'known':135B 'link':212B 'log':130B 'mani':172B 'match':184B 'most':201B 'number':15A,100B 'nvr/dvr':42A 'nvrs':71B 'old':19A,139B 'oper':187B 'outdat':144B 'over':31A 'p2p':10A,34A,93B,109B,157B 'password':17A,136B 'pattern':105B,183B 'predict':104B 'reach':113B 'risk':162B 'run':153B 'russia':205B 'say':168B 'serial':14A,99B 'set':80B 'sit':117B 'start':176B 'stream':77B 'taken':6A,30A 'target':170B 'two':214B 'ua':55B,165B,209B 'ukrain':56B,203B 'use':138B 'via':8A,32A 'video':76B 'view':75B 'warn':49B,57B 'weak':16A,133B 'week':59B","nicknames":["CameraSwarm"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:34:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T07:12:40+00:00","fetched_at":"2026-10-27T07:12:40+00:00","note":null}],"documents":[{"id":5543,"url":"https://x.com/TheHackersNews/status/2114972734367154635","title":"@TheHackersNews: 🚨 Dahua IP cameras compromised in Ukraine.\n\nCERT-UA confirms attackers gained ac","kind":"post","source":"x","text":"🚨 Dahua IP cameras compromised in Ukraine.\n\nCERT-UA confirms attackers gained access to video feeds, changed device settings, and created rogue accounts.\n\nThe attacks exploit Easy4IP P2P access alongside weak passwords or authentication bypass flaws.\n\nFull details ↓ https://t.co/6iQsjw6avS\n\nlikes 0 reposts 0","published_at":"2026-10-27T06:49:28+00:00","relation":"describes","confidence":null,"note":null},{"id":5550,"url":"https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html","title":"Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses","kind":"blog","source":"analyst","text":"The Hacker News (Ravie Lakshmanan), 2026-10-27, reporting a CERT-UA/SSSCIP alert issued the week of 2026-10-20. Confirmed cases of compromised Dahua IP cameras and DVRs: access to video streams, changed device configuration, third-party accounts created. Main initial access: Easy4IP P2P cloud. Serial numbers are predictable (10-char model prefix shared across a device family + 5-char hex counter incremented almost sequentially, e.g. 7K01F36PCA003E8), so attackers brute-force them to find cloud-connected devices without rate limits or lockouts; devices with P2P active are at risk even when not internet-exposed. Authentication is defeated with weak/known passwords or auth bypass flaws in outdated firmware (CVE-2021-33044, CVE-2021-33045). CERT-UA IoCs: unknown accounts; unauthorized config changes; audit logs with authentication events over the native DVRIP protocol from 127.0.0.1 (sign of P2P access). Advice: disable P2P if not needed, do not expose devices to the internet, update firmware. Not disclosed: targets, dates, device counts, attribution. Similar to Hunt.io's Operation CameraSwarm (14,530+ Dahua cameras, 17 Jun-22 Jul 2026, persistent backdoor account p2pwn / p2password on 1,923 cameras surviving password change and on most firmware a factory reset; 283 reached by serial via Dahua cloud relay; scanning TCP 37777).","published_at":"2026-10-27T06:34:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}