- CERT-UA says Dahua serial numbers follow a pattern, so attackers can guess them and spot cloud-connected cameras. Access still needs weak passwords or old flaws.
- Hunt.io believes one actor compromised over 14,530 Dahua cameras between June 17 and July 22, 2026. The campaign resembles, but is not confirmed as, the CERT-UA activity.
- Turn off peer-to-peer access where it is not needed, update firmware, and ask your team which cameras are cloud-connected.
A serial number tells attackers where to knock
Ukraine's CERT-UA has warned that the serial numbers of some Dahua cameras can be guessed. That lets attackers find cameras linked to the vendor's cloud. It does not, by itself, let them in.
The lesson here is that a guessable identifier works like a street address. It shows an attacker which doors exist. Whether one opens depends on the lock behind it.
CERT-UA's own wording is blunt. Assuming nobody knows the serial number, it said, "is not a reason to consider the device secure."
Who this reaches
The Hacker News describes the service at issue, Easy4IP, as a way to watch homes or small businesses remotely. It is not an enterprise product by that description.
Larger organisations may still run such cameras at small sites, such as a branch or a depot. That is a question for your team. The source does not say it happens.
How the guessing works
Easy4IP is a peer-to-peer (P2P) service. A phone app or web browser reaches a camera or recorder through the vendor's cloud. The user scans a QR code or types the serial number.
CERT-UA says the numbers are built on a pattern. The first 10 characters name the device family and repeat across every unit in it. The last five are a hexadecimal counter that climbs almost in order. The agency's example is 7K01F36PCA003E8.
With a pattern like that, an attacker can try numbers in bulk. CERT-UA says the service did not block these tries with rate limits or lockouts. Each hit reveals a cloud-connected device.
The agency adds that any device with P2P switched on is at risk, even if the internet cannot reach it directly.
The second step: passwords and old flaws
Finding a camera is not the same as controlling it. CERT-UA says attackers then get past login in one of two ways. They use weak or known passwords. Or they exploit authentication bypass flaws in outdated firmware, including CVE-2021-33044 and CVE-2021-33045.
Hunt.io's indicator list describes those two flaws as Dahua bypasses that allow login without a password. A camera installed years ago and never updated may still carry them.
CERT-UA recorded cases with access to video, changed settings and new third-party accounts. It did not say who was targeted, when it happened, how many devices were hit or who is responsible.
A similar campaign, not the same one
CERT-UA's findings resemble two clusters of activity that Hunt.io reported earlier. The resemblance is not a confirmed link.
In the first cluster, Hunt.io tied a Russian-speaking operator to attacks on 58 internet-facing cameras in Ukraine. The operator used known Dahua and Hikvision flaws and a public scanner called Ingram.
The second cluster is Operation CameraSwarm. Hunt.io believes one actor compromised over 14,530 Dahua cameras between June 17 and July 22, 2026. This campaign resembles, but is not confirmed as, the CERT-UA activity.
Its method differed from serial guessing. Hunt.io says the actor scanned for TCP port 37777, Dahua's default port, and collected serial numbers. It then used password guessing and the two CVEs to break in.
On 1,923 cameras, Hunt.io found a backdoor account called p2pwn. It says the account is stored apart from the admin password. It survives a password change and, on most firmware, a factory reset.
Within that campaign, Hunt.io says 283 cameras were reached through Dahua's cloud relay using only serial numbers. Those attackers needed no device address. In most cases, but not all, they needed no credentials. This is Hunt.io's finding. It is not CERT-UA's confirmed pattern.
A separate warning on cameras
Dutch intelligence agencies warned in July 2026 that Russian actors are compromising IP cameras to gather military intelligence. The source does not tie that warning to CERT-UA's Dahua cases.
The general point still holds. A camera feed shows who comes and goes, and when. That is operational information, and a compromised camera hands it to someone else.
What to ask your team
CERT-UA advises turning off P2P where it is not needed, keeping devices off the open internet and updating software. Leaders can turn that into four questions.
First, how many cameras and recorders do we own, and who looks after them? Second, which have P2P or cloud access on, and why? Third, which run firmware old enough to carry CVE-2021-33044 or CVE-2021-33045? Fourth, do our logs show logins over Dahua's native protocol from the local address 127.0.0.1? CERT-UA describes that as a sign of P2P access.
Also ask whether a factory reset counts as a clean-up. Hunt.io says its backdoor account survived resets on most firmware. A reset alone does not show a camera is clean.
Assume the serial number is findable. Then put strong passwords and current firmware behind it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hacker News.
