Dahua IP cameras and recorders: P2P cloud access hijacking

CERT-UA has identified an ongoing campaign where attackers exploit Dahua surveillance devices via the Easy4IP P2P cloud access service. Attackers leverage predictable serial number patterns to reach devices through the manufacturer’s cloud relay, bypassing NAT and firewall protections. Once access to the device management interface is obtained, attackers attempt to compromise the device using weak or default passwords, or by exploiting authentication bypass vulnerabilities CVE-2021-33044 and CVE-2021-33045 on unpatched firmware. Confirmed indicators of compromise include the presence of unknown user accounts, unauthorized changes to device configuration, and suspicious DVRIP login events originating from 127.0.0.1.

Attack Chain

1. Serial Number Discovery: Attackers probe the Easy4IP P2P service by guessing or iterating through predictable device serial numbers.
2. Cloud Relay Traversal: Attackers utilize the P2P connection to communicate with the target device, effectively bypassing local network perimeter controls.
3. Authentication Attempt: Attackers attempt to authenticate to the device management service using common/default credentials or by chaining CVE-2021-33044 and CVE-2021-33045.
4. Device Compromise: Upon successful authentication, attackers gain administrative access to the device.
5. Persistence: Attackers create unauthorized backdoor accounts (e.g., "p2pwn") to maintain future access.
6. Impact: Attackers modify device settings, view video streams, and apply visual overlays to the video feed.

Impact

Unauthorized access to surveillance video, loss of device configuration control, and potential use of cameras as entry points into internal network segments. CERT-UA has confirmed active hijacking and exploitation campaigns.

Recommendation

• Disable P2P/Cloud Access immediately on all Dahua devices unless explicitly required for business operations.
• Patch all affected Dahua IP cameras, NVRs, and DVRs to the latest firmware to remediate CVE-2021-33044 and CVE-2021-33045.
• Audit existing device accounts and remove any unknown or unauthorized user entries.
• Isolate surveillance devices into a dedicated VLAN with restricted access to the internet and internal production networks.