Vulnerabilities

Dahua cameras hijacked through the Easy4IP cloud relay

By Yaali. October 28, 2026, 6 min read, Vulnerabilities, Threat intel, Patching.

CERT-UA warns attackers are taking over Dahua cameras and recorders via Easy4IP P2P, even behind NAT. How it works, what to check and what to switch off.

CERT-UA, Ukraine's national computer emergency response team, warned on October 23 that attackers are taking remote control of Dahua IP cameras, network video recorders (NVRs) and digital video recorders (DVRs). Intruders have watched live video, changed device settings, added text over the picture and created their own accounts. The way in is Easy4IP, Dahua's peer-to-peer (P2P) cloud service, which lets the mobile app reach a camera with nothing more than its serial number.

That route matters because it ignores the usual perimeter. A camera with P2P switched on dials out to Dahua's cloud and waits there, so a recorder with no public IP address and no open port can still be reached from the internet. CERT-UA's own words: the lack of direct access from the internet does not guarantee the security of a device with the P2P function active. If you have Dahua or Dahua-made rebranded cameras anywhere, including sites nobody has looked at in years, this applies to you.

How it works

Most cameras sit behind a router doing network address translation (NAT), so nothing on the internet can open a connection to them. Instead, the camera keeps an outbound session open to Dahua's relay (Hunt.io names it as easy4ipcloud.com), registered under its serial number. When the app asks for that serial, the relay stitches the two sessions together and the app talks to the camera's management service, normally TCP port 37777, through the tunnel.

The weak point is the serial number. CERT-UA says serials follow a predictable structure: a 10-character model prefix shared by every unit in a device family, then a 5-character hexadecimal counter that rises almost in sequence, as in the example 7K01F36PCA003E8. An attacker who knows one serial can walk the counter and ask the relay which neighbours are online, and CERT-UA says this works at scale without hitting rate limits or lockouts. Hunt.io adds that serials also leak through Dahua's dynamic DNS names, which take the form {serial}.dahuaddns.com.

Reaching the camera still leaves its login. Here the attackers use weak or default passwords, or two authentication bypasses on outdated firmware. CVE-2021-33044 (CVSS 9.8 in the National Vulnerability Database, 8.1 in Dahua's own rating) makes the firmware trust a client that claims to be a NetKeyboard controller and skip the password check. CVE-2021-33045 (also 9.8 at NVD) makes it believe a login claiming to come from 127.0.0.1, the device's own loopback address. Dahua fixed both in 2021 and CISA added both to its Known Exploited Vulnerabilities catalog on August 21, 2024.

The P2P tunnel adds a twist that helps defenders. Traffic arriving through the relay reaches the camera's service from the device itself, so the camera's audit log records a DVRIP login (DVRIP is Dahua's proprietary management protocol) from 127.0.0.1. CERT-UA calls that a marker of access through the cloud service.

What attackers are doing

CERT-UA has not said who is behind the activity, who was hit or how many devices are affected. The best public picture of the method comes from earlier research. In August, Hunt.io described Operation CameraSwarm, in which one Russian-speaking operator compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, mostly in Ukraine and Russia. Hunt.io found the numbers in the operator's own exposed working directory.

Hunt.io split the haul into three routes. Password guessing against port 37777 accounted for 12,324 unique IP addresses. The two 2021 bypasses gave access to 1,923 cameras, each of which then got a hidden account, p2pwn with password p2password, added over Dahua's remote procedure call (RPC) interface. Another 283 cameras were reached through the relay by serial number alone, including devices behind NAT. Hunt.io says the backdoor account is stored apart from the admin password, so it survives a password change and, on most firmware, a factory reset.

Treat the campaign figures with some care. The Hacker News noted in August that public sources confirm the bypasses, the p2pwn tool and the serial mechanism, but not the totals, which come from the operator's records. ITRES Labs, which first documented the relay issue, says firmware released after mid-2024 hardened the P2P path, so older firmware is where the relay route works best. Dahua's response at the time was that the attacks mainly involved password cracking and the 2021 flaws.

Cameras are worth this effort. On July 10, 2026, the Dutch intelligence services AIVD and MIVD said at least one Russian intelligence service was compromising internet-connected cameras in the Netherlands, other NATO states and Ukraine, running image recognition over the feeds to find military vehicles and their cargo.

What to do

1. Find every device. Include NVRs, DVRs and rebranded Dahua hardware sold under other names. CERT-UA specifically asks for forgotten devices to be audited. Scan internal ranges for TCP 37777 and the web interface on 80 and 443.
2. Turn off P2P where nobody uses the app. In the device web interface the option sits under the network settings (usually Setting, Network, P2P or Easy4IP); clear Enable and save. Menu labels vary by model and firmware, so check each type. Then block outbound traffic from the camera VLAN to the internet, which stops a device from re-registering if the setting comes back after an update.
3. Update firmware by hand from Dahua's official site to the latest build for each model. That closes CVE-2021-33044 and CVE-2021-33045 and picks up the post-2024 relay hardening.
4. Keep management ports off the internet. No port forwarding for 37777. For remote viewing, CERT-UA says to use a VPN and allow only approved IP addresses.

Then look for signs that someone was already in:

• An account you did not create, p2pwn in particular, and any unknown cloud account linked to the device.
• Settings you did not change, including text overlaid on the video.
• Audit log entries for DVRIP logins from 127.0.0.1.
• If your network sensors can see camera traffic, Hunt.io says login requests with "clientType": "NetKeyboard", or "loginType": "Loopback" with "ipAddr": "127.0.0.1", do not occur in legitimate Dahua client traffic.

CERT-UA adds that a clean result does not prove a device is safe. For any device with a hit, assume every credential it stored is exposed, including the ONVIF passwords an NVR uses to talk to its cameras, which Hunt.io saw the operator dump. Update the firmware, then factory reset as Dahua advises, recreate the admin account with a new password and check the account list again afterwards, since Hunt.io reports that the backdoor can survive a reset on most firmware.

The wider lesson

Asset lists tend to treat "not exposed" as "no open inbound port". Cloud relays break that assumption for cameras, printers, smart building controllers and remote support tools alike: the device makes the connection itself, so the vendor's cloud is a way in that no inbound rule covers. Firewall rules that deny outbound traffic from IoT segments by default, with named exceptions, catch this class of problem far better than port scans from outside.

If you want to know which of your cameras and recorders can be reached this way, our network penetration testing team tests exactly that, and safeguarding and hardening covers segmenting and locking down IoT estates. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: SSSCIP / CERT-UA alert, The Hacker News, Security Affairs, dev.ua, Hunt.io, Operation CameraSwarm, The Hacker News, August 2026, NVD CVE-2021-33044, NVD CVE-2021-33045, CISA KEV catalog, Security Affairs on the AIVD and MIVD advisory.