Attackers seize Dahua cameras through Easy4IP cloud access

Ukraine’s CERT-UA has warned that attackers can remotely take control of Dahua IP cameras and video recorders via Easy4IP, Dahua’s cloud-based remote access feature. In a 23 October 2026 alert, CERT-UA states that intruders have been able to view live video, alter device settings and create their own accounts. The advisory does not specify targets or the number of affected devices.

The researchers explain that the main attack vector is Easy4IP, the P2P/cloud access function. When enabled, a device connects to Dahua’s cloud and registers using its serial number; whoever knows that serial number may access the device through the cloud, bypassing NAT and firewall and without published ports or a white IP address. As a result, devices not directly internet-exposed can still be at risk.

CERT-UA notes that devices with Easy4IP enabled may be vulnerable even if they cannot be reached directly from the internet. Serial numbers follow predictable patterns, so attackers may programmatically guess registered devices and test them for cloud access. After cloud access, attackers need to bypass login, potentially using weak passwords or exploits in outdated firmware, notably CVE-2021-33044 and CVE-2021-33045, which allow authentication bypass without a password.

CERT-UA lists four practical steps: turn off P2P and cloud access if unused; keep cameras offline and use a VPN with authorised IPs for remote access; audit accounts and disconnect unknown cloud links; and manually update to the latest software, establishing a regular update routine. If signs of compromise appear, organisations should report them and examine Dahua devices on networks, including those forgotten.