TL;DR

what: CERT-UA reports that attackers are guessing predictable Dahua serial numbers to reach IP cameras, NVRs and DVRs through the Easy4IP P2P cloud relay, then logging in with weak passwords or the CVE-2021-33044 and CVE-2021-33045 authentication bypasses.

impact: Attackers have watched live video, changed device settings and created rogue accounts, and a related Hunt.io campaign compromised over 14,530 Dahua cameras and backdoored 1,923 of them.

fix: CERT-UA advises disabling P2P where it is not needed, keeping devices off the direct internet and running current Dahua firmware that addresses CVE-2021-33044 and CVE-2021-33045.

who: Any organization running Dahua cameras, NVRs or DVRs with P2P turned on, including devices behind NAT, and especially sites in Ukraine and NATO states that watch logistics, transport or military movement.

Attackers are taking over Dahua IP cameras, NVRs and DVRs in Ukraine without needing a routable IP address.…