Dahua Cameras Hijacked Through Cloud Access, Even Behind Firewalls

Firewalls alone may not prevent attackers from hijacking cloud-connected security cameras.

Ukraine's computer emergency response team, CERT-UA, warned in October 2026 that attackers had compromised Dahua surveillance cameras and video recorders through cloud-enabled access. The agency documented unauthorized access to video feeds, altered configurations, and rogue accounts.

The attacks involve Dahua's Easy4IP remote-access service, which can make devices reachable behind firewalls. Attackers may then exploit weak credentials or vulnerable firmware to gain unauthorized control.

"Security cameras are supposed to help protect organizations, but when they're compromised, they can become surveillance tools for attackers," said Phillip Wylie, chief security evangelist at Suzu Labs. He warned that attackers could gain visibility into personnel, operations, and physical security.

How Easy4IP exposes cameras behind firewalls

According to CERT-UA's security warning, Easy4IP enables cloud-mediated peer-to-peer (P2P) monitoring. Predictable serial-number patterns can help attackers identify connected devices without scanning exposed management ports.

Two authentication-bypass vulnerabilities, CVE-2021-33044 and CVE-2021-33045, affect certain Dahua products. The Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalog on August 21, 2024. Dahua's security advisory identifies affected products and fixes, although their use in the October incidents remains unconfirmed.

An earlier campaign illustrates the potential scale. Hunt.io's Operation CameraSwarm investigation documented more than 14,530 compromised Dahua devices between June 17 and July 22, 2026. Researchers identified 1,923 cameras with persistent backdoor accounts and 283 devices accessed through cloud relays. Some backdoors survived password changes and factory resets. No connection to the October incidents has been established.

Cloud access audits and compromise checks

Wylie cautioned that IoT devices are often installed and forgotten, leaving outdated firmware, weak credentials, and unnecessary internet exposure unaddressed. Security teams should prioritize these measures:

1. Inventory devices and restrict cloud access: Identify active Easy4IP connections, disable unnecessary P2P access, review cloud-linked accounts, and restrict outbound traffic.
2. Update firmware and replace unsupported devices: Apply vendor-supported fixes and replace equipment that cannot be secured. Recent Cisco Meraki camera vulnerabilities reinforce the need for supported firmware.
3. Strengthen authentication: Replace weak credentials, review administrative permissions, and investigate unfamiliar accounts, including the p2pwn backdoor identified in earlier attacks.
4. Monitor suspicious activity: Investigate DVRIP authentication events involving 127.0.0.1, a possible P2P access indicator. Correlate findings with configuration changes before concluding compromise occurred.
5. Segment surveillance networks: Restrict management access and isolate cameras from critical systems. Similar risks arise when attackers compromise trusted infrastructure, including Cisco routers.
6. Preserve evidence and verify recovery: Collect logs before remediation, remove unauthorized access, and verify recovery. Recent Ivanti VPN attacks demonstrate how stolen credentials may remain usable after patching.
7. Test incident response plans: Exercise device isolation, cloud-account containment, evidence collection, and restoration with security and facilities teams.

Wylie urged manufacturers to prioritize secure defaults, strong authentication, and reliable firmware updates while emphasizing organizations' responsibility for device security.

"Ultimately, a security camera is another computer connected to your network, and it needs to be treated with the same level of security attention as any other endpoint," he said.

CERT-UA has not disclosed the number of devices compromised in October or identified the attackers. Organizations should investigate unauthorized access and verify remediation rather than relying on firewall protections alone.

Stay informed: Keep up with Europe's latest technology, AI, and cybersecurity developments. Subscribe to Tech Insider Europe for free for essential coverage of the region's evolving technology landscape.