Dahua Cameras Hijacked in Ukraine via Easy4IP P2P Relay and Guessable Serial Numbers
TL;DR what: CERT-UA reports that attackers are guessing predictable Dahua serial numbers to reach IP cameras, NVRs and DVRs through the Easy4IP P2P cloud relay, then logging in with weak passwords or the CVE-2021-33044 and CVE-2021-33045 authentication bypasses. impact: Attackers have watched live video, changed device settings and created rogue accounts, and a related Hunt.io campaign…
CERT-UA, the State Special Communications Service of Ukraine, has reported that attackers are breaching Dahua IP cameras, NVRs and DVRs in Ukraine through an Easy4IP P2P cloud relay using guessable serial numbers. Once connected, attackers can watch live video, alter device settings and create unauthorized accounts. The vulnerability stems from Dahua serial numbers being predictable and easily enumerated, allowing attackers to find and access devices even if they are not directly reachable on the internet.
This issue has been exacerbated by the CVE-2021-33044 and CVE-2021-33045 authentication bypass vulnerabilities, which enable passwordless login on outdated firmware. The compromised cameras have been used in separate campaigns by Russian and Ukrainian-speaking attackers, with over 14,530 Dahua cameras backdoored in total. CERT-UA recommends disabling P2P when unnecessary, keeping devices disconnected from the internet and running the latest Dahua firmware to address the identified vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
