---
id: "CMP-202610-dahua-ip-cameras-and-dvrs-taken-over-via-easy4ip-p2p-cloud-b"
kind: "campaign"
aliases: []
title: "Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Dahua IP cameras", "fixed": [], "affected": "devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045", "ecosystem": "vendor"}, {"name": "Dahua NVR/DVR", "fixed": [], "affected": "devices with Easy4IP P2P enabled and weak passwords or outdated firmware", "ecosystem": "vendor"}, {"name": "Dahua Easy4IP", "fixed": [], "affected": "P2P cloud access feature", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "dahua", "early-warning", "ip-camera"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T07:12:40+00:00"
updated_at: "2026-10-27T07:12:40+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T07:12:40+00:00"}]
---

# Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

CERT-UA (Ukraine) warned the week of 2026-10-20 about confirmed compromises of Dahua IP cameras, NVRs and DVRs: attackers view video streams, change device settings and create their own accounts. They find devices through Dahua's Easy4IP P2P cloud by brute-forcing serial numbers, which follow a predictable pattern, so devices with P2P on can be reached even when they sit behind a firewall/NAT and are not exposed to the internet. They then log in with weak or known passwords, or use old auth bypass flaws in outdated firmware (CVE-2021-33044, CVE-2021-33045). Anyone running Dahua cameras/recorders with P2P (Easy4IP) on is at risk. CERT-UA did not say which targets, how many devices, when it started or who is behind it. The pattern matches Hunt.io's Operation CameraSwarm (14,530+ Dahua cameras compromised 2026-06-17 to 2026-07-22, mostly in Ukraine and Russia), but CERT-UA has not linked the two.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Dahua IP cameras affected devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045 fixed ?
- vendor:Dahua NVR/DVR affected devices with Easy4IP P2P enabled and weak passwords or outdated firmware fixed ?
- vendor:Dahua Easy4IP affected P2P cloud access feature fixed ?

## How to check

On Dahua cameras/NVRs/DVRs: look for user accounts you did not create (CameraSwarm planted a backdoor account p2pwn / p2password that survives password changes and, on most firmware, factory reset); unexplained configuration changes; audit log entries showing authentication over the DVRIP protocol from 127.0.0.1 (sign of P2P/Easy4IP access). Check whether P2P/Easy4IP is enabled, whether TCP 37777 is reachable from the internet, and whether firmware still has CVE-2021-33044/33045.

## Fix

Turn off P2P/Easy4IP on Dahua devices unless you need it. Do not expose the devices (TCP 37777, web UI) to the internet. Update firmware to versions that fix CVE-2021-33044/33045. Change default or weak passwords. Remove unknown accounts; if you find p2pwn or other rogue accounts, assume the device is compromised and reflash or replace it. Put cameras on an isolated network segment.

## Timeline

- 2026-10-27T07:12:40+00:00 analyst

## Documents

- [describes] @TheHackersNews: 🚨 Dahua IP cameras compromised in Ukraine.

CERT-UA confirms attackers gained ac https://x.com/TheHackersNews/status/2114972734367154635
- [describes] Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_