{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3odahuasecuritynvr-1xxx_firmware/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dahuatech:*:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd49_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2021-33044"},{"cvss":9.8,"id":"CVE-2021-33045"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IP cameras (all firmware \u003c fixes for CVE-2021-33044/45)","NVRs (all firmware \u003c fixes for CVE-2021-33044/45)","DVRs (all firmware \u003c fixes for CVE-2021-33044/45)","IP cameras","NVRs","DVRs"],"_cs_severities":["high"],"_cs_tags":["dahua","iot","auth-bypass","cisa-kev","ukraine"],"_cs_type":"advisory","_cs_vendors":["Dahua"],"content_html":"\u003cp\u003eCERT-UA has identified an ongoing campaign where attackers exploit Dahua surveillance devices via the Easy4IP P2P cloud access service. Attackers leverage predictable serial number patterns to reach devices through the manufacturer’s cloud relay, bypassing NAT and firewall protections. Once access to the device management interface is obtained, attackers attempt to compromise the device using weak or default passwords, or by exploiting authentication bypass vulnerabilities CVE-2021-33044 and CVE-2021-33045 on unpatched firmware. Confirmed indicators of compromise include the presence of unknown user accounts, unauthorized changes to device configuration, and suspicious DVRIP login events originating from 127.0.0.1.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eSerial Number Discovery: Attackers probe the Easy4IP P2P service by guessing or iterating through predictable device serial numbers.\u003c/li\u003e\n\u003cli\u003eCloud Relay Traversal: Attackers utilize the P2P connection to communicate with the target device, effectively bypassing local network perimeter controls.\u003c/li\u003e\n\u003cli\u003eAuthentication Attempt: Attackers attempt to authenticate to the device management service using common/default credentials or by chaining CVE-2021-33044 and CVE-2021-33045.\u003c/li\u003e\n\u003cli\u003eDevice Compromise: Upon successful authentication, attackers gain administrative access to the device.\u003c/li\u003e\n\u003cli\u003ePersistence: Attackers create unauthorized backdoor accounts (e.g., \u0026quot;p2pwn\u0026quot;) to maintain future access.\u003c/li\u003e\n\u003cli\u003eImpact: Attackers modify device settings, view video streams, and apply visual overlays to the video feed.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized access to surveillance video, loss of device configuration control, and potential use of cameras as entry points into internal network segments. CERT-UA has confirmed active hijacking and exploitation campaigns.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDisable P2P/Cloud Access immediately on all Dahua devices unless explicitly required for business operations.\u003c/li\u003e\n\u003cli\u003ePatch all affected Dahua IP cameras, NVRs, and DVRs to the latest firmware to remediate CVE-2021-33044 and CVE-2021-33045.\u003c/li\u003e\n\u003cli\u003eAudit existing device accounts and remove any unknown or unauthorized user entries.\u003c/li\u003e\n\u003cli\u003eIsolate surveillance devices into a dedicated VLAN with restricted access to the internet and internal production networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T10:07:50Z","date_published":"2026-10-27T08:32:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dahua-p2p-hijacking/","summary":"Attackers are hijacking Dahua IP cameras and recorders via the Easy4IP P2P cloud access feature by using brute-force attacks or exploiting CVE-2021-33044 and CVE-2021-33045 to gain unauthorized device control.","title":"Dahua IP cameras and recorders: P2P cloud access hijacking","url":"https://feed.craftedsignal.io/briefs/2026-10-dahua-p2p-hijacking/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}