As reported by SecurityAffairs, Ukraine's CERT-UA issued an alert on October 23, 2026 warning that attackers are remotely compromising Dahua IP cameras and video recorders through the Easy4IP P2P cloud feature — viewing live video feeds, modifying device settings, and creating rogue accounts on targeted surveillance systems.
This advisory deserves more attention than a typical IoT botnet story. The Easy4IP attack vector fundamentally breaks a security assumption that many network defenders and physical security teams hold implicitly: that a camera behind NAT, with no exposed public IP and no port forwarding, is not reachable from the outside. That assumption is no longer valid when P2P cloud features are enabled.
Why the Easy4IP Vector Is Different
Most IoT compromise campaigns we track rely on scanning for devices directly exposed to the internet — typically via Shodan or Censys enumeration of open RTSP, HTTP, or proprietary protocol ports. Easy4IP inverts that model. The device itself initiates an outbound connection to Dahua's cloud infrastructure and registers using its serial number. An attacker who knows or can enumerate that serial number can then tunnel back through the cloud relay and interact with the device, all without touching the perimeter firewall.
CERT-UA notes that serial numbers follow predictable patterns, making automated enumeration feasible at scale. This means a camera sitting on a private VLAN inside a corporate facility — one that a network engineer would confidently tell you is unreachable from the internet — may still be fully accessible to a remote attacker who enumerates its cloud registration.
Authentication Bypass CVEs Compound the Risk
The advisory references two known Dahua authentication bypass vulnerabilities that allow attackers to connect without valid credentials:
| CVE | Description | Severity | Patch Status |
|---|---|---|---|
| CVE-2021-33044 | Authentication bypass in select Dahua products via crafted requests | High / Critical | Patch available — update firmware |
| CVE-2021-33045 | Authentication bypass allowing unauthorized device access | High / Critical | Patch available — update firmware |
These CVEs were disclosed in 2021, yet the fact that CERT-UA is still flagging active exploitation in 2026 tells us everything we need to know: a significant population of Dahua devices remains unpatched in the field. When you combine an externally reachable cloud tunnel with an authentication bypass that ignores passwords entirely, you have a fully remote, credential-free takeover path. Strong passwords — the most common remediation advice for IoT — provide zero protection against these CVEs.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Disable Easy4IP on all Dahua devices. This is the single most effective mitigation. If remote access is required, use a VPN or Zero Trust Network Access solution instead of the manufacturer's P2P cloud.
- Update firmware immediately to a version that patches CVE-2021-33044 and CVE-2021-33045. Contact Dahua support if the latest firmware for your model is unclear.
- Audit device accounts. Enumerate all user accounts on every Dahua DVR and camera. Remove any unrecognized accounts. Reset the admin password to a unique, strong value.
- Check audit logs for 127.0.0.1 DVRIP logins. CERT-UA identifies this as a key indicator of compromise — a local-loopback login via the DVRIP protocol suggests a cloud-tunneled session.
- Inspect on-screen display overlays. Attackers have been observed adding text overlays to video feeds. Check all camera streams for unexpected OSD text.
- Segment camera networks. Place IoT surveillance equipment on an isolated VLAN with no route to corporate data or internet egress except through controlled proxies or firewalls.
Broader Defensive Posture
This incident reinforces a principle we have been advocating across the IoT security landscape: any device that initiates outbound connections to a manufacturer-controlled cloud is effectively internet-exposed, regardless of your network topology. Asset inventories must include not just IP and MAC addresses but also cloud registration status, P2P feature state, and firmware version. Organizations should treat IoT cloud/P2P features the same way they treat any other inbound exposure — with inventory, monitoring, and the ability to disable.
We also recommend that defenders conducting threat hunts search egress logs for connections to Dahua cloud infrastructure endpoints. Even if you cannot see the inbound session, the outbound registration traffic is visible and can identify devices that still have Easy4IP active.
