Ukraine Warns of Widespread Security Vulnerabilities and Unauthorized Remote Access Targeting Dahua Surveillance Systems

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a high-priority security alert warning organizations and citizens about unauthorized remote access exploits targeting video surveillance systems manufactured by Dahua. The discovery highlights growing digital threats to physical infrastructure, revealing how malicious actors are exploiting predictable device architecture and cloud integration services to compromise internet-connected hardware on a mass scale.

According to an official advisory released by the State Special Communications Service of Ukraine (SSSCIP), investigators have recorded numerous cases of IP cameras and digital video recorders (DVRs) being compromised. In these security breaches, unauthorized individuals gained live access to video streams, altered core device configurations, and established persistent third-party accounts without the knowledge or consent of the legal owners.

The primary initial access vector leveraged in these attacks relies on Easy4IP, a peer-to-peer (P2P) platform designed by the manufacturer. This platform allows users to remotely monitor residential properties or small business environments by connecting their Dahua IP cameras, network video recorders (NVRs), and DVRs through a dedicated smartphone application or a standard web browser. Connection is typically established effortlessly by scanning a QR code or inputting the hardware’s unique Serial Number.

However, security analysts have discovered a structural vulnerability within how these hardware identifiers are generated. The serial numbers follow a highly predictable pattern, consisting of a 10-character model prefix that remains identical across all units within the same device family, paired with a five-character hexadecimal counter that increments almost sequentially. This structural flaw enables malicious actors to execute automated, large-scale brute-force attacks to guess valid serial numbers. Because these checks can be performed without triggering rate limits or account lockouts, attackers can rapidly determine whether a specific device is connected to the cloud infrastructure.

As a consequence of this design weakness, virtually all video surveillance hardware with active P2P functionality remains exposed to risk, even when devices are properly configured behind firewalls and cannot be accessed directly via the public internet. Emphasizing the severity of this oversight, CERT-UA warned that assuming a device remains secure simply because its serial number is treated as private information is a dangerous misconception.

To overcome remaining authentication barriers, threat actors have been observed leveraging weak or default factory passwords, as well as exploiting known authentication bypass vulnerabilities embedded within outdated firmware versions, specifically referencing vulnerabilities cataloged as CVE-2021-33044 and CVE-2021-33045. To counter these compounding threats, cybersecurity authorities strongly advise users to disable the P2P feature entirely if remote cloud monitoring is not strictly necessary, to avoid exposing management interfaces directly to the internet, and to ensure that all device firmware is updated to the latest available versions.

While the Ukrainian agency did not publicly disclose precise details regarding the specific targets, the timeline of individual infections, the exact number of compromised units, or the identities behind the hostile operations, cybersecurity researchers have noted striking parallels with other documented campaigns. In particular, threat intelligence firm Hunt.io recently published findings detailing parallel clusters of malicious activity targeting IP cameras across Ukraine and neighboring regions.

One such campaign has been attributed to a Russian-speaking operator who systematically targeted internet-exposed cameras located within Ukraine using known vulnerabilities in equipment manufactured by Dahua and Hikvision. This campaign successfully compromised dozens of devices by integrating Ingram, a publicly available automated webcam vulnerability scanner, to locate and exploit vulnerable endpoints. In parallel, the same threat actor expanded their operational scope, executing widespread scanning and exploitation campaigns against routers and cameras manufactured by TP-Link and MikroTik. These subsequent attacks leveraged vulnerabilities such as CVE-2024-53375 and CVE-2024-57049, affecting systems across 15 European countries, including Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the United Kingdom, and Austria.

A second major campaign, codenamed Operation CameraSwarm and attributed to a lone threat actor, is believed to have compromised more than 14,530 Dahua IP cameras over a single month. This operation relied on a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044 and CVE-2021-33045 vulnerability chain. The attack cycle typically begins with automated network scanning for TCP port 37777, the default proprietary management and video streaming port utilized by Dahua devices. Once an open port is identified, the malicious framework collects the hardware serial number, breaches the device using the aforementioned exploitation methods, and deploys a persistent backdoor account known as p2pwn or p2password.

Security researchers investigating Operation CameraSwarm discovered that nearly 2,000 cameras were fitted with this persistent backdoor account installed via remote procedure calls after an authentication bypass. Crucially, this backdoor is stored independently of the primary administrator password, allowing it to survive standard password modifications and, on the vast majority of firmware configurations, even complete factory resets. Furthermore, researchers noted that hundreds of cameras were successfully reached using only their serial numbers through Dahua’s cloud relay mechanism, requiring neither a direct device address nor valid credentials. In these instances, attackers abused the manufacturer’s cloud relay architecture to bypass Network Address Translation (NAT) barriers and reach isolated internal cameras.

The wave of surveillance system compromises aligns with broader intelligence assessments published earlier this year by European cybersecurity authorities. In previous intelligence briefings, Dutch security agencies warned that state-backed actors are systematically compromising IP cameras across European Union member states, NATO territories, and Ukraine to conduct digital espionage and harvest critical military intelligence.

According to those intelligence findings, malicious operators have deployed automated image recognition software to systematically analyze video feeds captured by compromised civilian and commercial cameras. These automated searches are specifically tuned to identify military vehicles, logistical convoys, and the transportation of heavy military cargo. By hijacking these visual feeds, threat actors gain valuable operational data, including alliance military transport routes, the timing and delivery pathways of weapon shipments destined for Ukraine, and the specific deployment locations of military personnel. Intelligence reports indicate that this harvested visual intelligence has been directly utilized in attempts to track Ukrainian military movements and target defensive material.