Ukraine Warns Hackers Are Breaking Into Dahua Security Cameras Through a Cloud Remote Access Feature

Ukraine's computer emergency response team, CERT-UA, has warned that hackers are gaining unauthorised access to surveillance cameras and video recorders made by Chinese manufacturer Dahua. The agency said attackers changed device settings and created unauthorised user accounts, which could expose video feeds and allow remote control of the devices. CERT-UA did not say how many devices were affected, when the attacks occurred or who was responsible.

According to CERT-UA, the attackers appear to be exploiting Easy4IP, a feature that lets users reach Dahua cameras through the manufacturer's cloud service using device serial numbers. Because those serial numbers follow predictable patterns, hackers can guess large numbers of them and identify cameras connected to the cloud. Devices with the feature enabled could therefore be at risk even if their serial numbers were never made public. Once a device is found, attackers can try weak or default passwords, or use security flaws in outdated firmware to bypass authentication. The agency pointed to two critical vulnerabilities from 2021, CVE-2021-33044 and CVE-2021-33045.

The warning follows a Hunt.io report in August that more than 14,500 Dahua devices were compromised earlier in the summer, with confirmed infections concentrated in Ukraine and Russia. The attackers reportedly used similar techniques, though it is unclear whether those incidents are linked to the activity CERT-UA describes.