Hackers may be able to take control of Dahua IP cameras and video recorders through the manufacturer’s Easy4IP/P2P cloud-access feature, even when the devices are not directly exposed to the internet. Ukraine’s national cyber incident response team, CERT-UA, has reported cases of unauthorized access involving live video feeds, configuration changes and the creation of rogue user accounts. The warning highlights a security gap that organizations can easily overlook: keeping surveillance devices behind a firewall does not necessarily protect them when cloud-based remote access remains enabled.
Internet-connected surveillance cameras are designed to keep people and facilities under watch. But when their remote-access features are not properly secured, those same devices can become a way for attackers to watch, change settings or gain a foothold inside an organization’s network.
Ukraine’s national computer emergency response team, CERT-UA, has warned of incidents involving unauthorized remote access to Dahua video surveillance systems. According to the alert published by Ukraine’s State Service of Special Communications and Information Protection, compromised IP cameras and video recorders were accessed to view video streams, modify device configurations and create unauthorized accounts.
The reported attack path involves Dahua’s Easy4IP/P2P cloud-access functionality. The feature allows users to view and manage compatible devices remotely without having to configure conventional internet-facing ports.
Research published by ITRES Labs in October 2025 describes how weaknesses in this access model, particularly on older firmware, can expose devices that appear to be protected behind routers and firewalls. The researchers investigated a real incident in which Dahua surveillance devices were compromised despite having no directly exposed internet ports.
The findings highlight a security issue that organizations can easily overlook: a device does not need a publicly accessible IP address to be reachable through an external cloud relay.
How the Easy4IP/P2P Access Model Creates Risk
Dahua’s Easy4IP functionality is designed to make remote surveillance convenient. As described in the manufacturer’s documentation, compatible devices can register for P2P access and be viewed through the associated mobile application when the feature is enabled and the device is connected to the internet.
Under this model, a camera or recorder initiates an outbound connection to the vendor’s cloud infrastructure. The service can then help establish a remote session without requiring the user to open inbound ports on the local router.
That convenience also creates an access path that may not be obvious to network administrators.
According to CERT-UA, attackers have abused the P2P/cloud-access mechanism to reach affected devices through the cloud service. The advisory describes device serial numbers as a potential means of identifying targets and warns that their predictable structure may allow attackers to discover active devices through automated guessing.
ITRES Labs reported similar behavior during its investigation, finding that certain older firmware versions allowed relay connections to be initiated using a valid serial number before the device’s normal credential checks were completed. The researchers also reported weaknesses in serial-number enumeration protections.
These findings should be understood in their technical context. ITRES’s research indicates that the behavior differs across firmware generations, with newer firmware released from around mid-2024 introducing additional authentication checks in the P2P access flow. The precise exposure of any individual device therefore depends on its model, firmware and configuration.
The central lesson remains straightforward: blocking direct inbound internet traffic does not necessarily eliminate remote access through a cloud relay.
Weak Passwords and Outdated Firmware Make Matters Worse
Discovering a device is only one part of an attack. An attacker must still obtain sufficient access to carry out actions such as viewing streams, changing settings or creating accounts.
CERT-UA identifies weak or default credentials and authentication-bypass vulnerabilities in older firmware as possible routes to compromise. The alert specifically references CVE-2021-33044 and CVE-2021-33045.
These older vulnerabilities reinforce the importance of maintaining supported firmware and replacing default credentials. A device that has been deployed for years without a security review may retain weaknesses that have already been documented and addressed in later software releases.
ITRES Labs also highlighted a related problem: some devices may display an indication that their firmware is up to date even when a newer version is available from the manufacturer’s website. In the researchers’ investigation, the discrepancy involved a customized device that was not eligible for cloud-based updates.
This does not establish that every Dahua device has a faulty update mechanism. It does show why administrators should verify firmware availability manually rather than relying exclusively on an in-device status message.
What Are the Signs of a Compromised Camera?
CERT-UA lists several indicators that security and surveillance teams should investigate.
Unknown user accounts: An unfamiliar account on a camera or recorder may indicate that someone has gained administrative access. Review both local accounts and accounts associated with cloud services.
Unexpected configuration changes: Changes to network settings, access permissions or other device configurations may indicate unauthorized activity.
Unusual text overlays: The appearance of unfamiliar text over a video feed can be a sign of compromise. However, the absence of overlays does not mean that a device is safe.
Suspicious audit-log entries: CERT-UA highlights authentication events involving the manufacturer’s native DVRIP protocol and the local address 127.0.0.1. These entries may be consistent with access through a P2P relay, although they should be assessed alongside other logs and device-specific context rather than treated as conclusive proof on their own.
Organizations should preserve relevant logs and configuration records when investigating suspected compromise. If unauthorized access is confirmed, they should also determine whether the affected recorder or camera could communicate with other systems on the network.
Why This Matters Beyond Surveillance
A compromised camera is not simply a privacy problem.
In a business environment, surveillance systems can reveal staff movements, security procedures, sensitive operational areas and information about when facilities are occupied. Unauthorized access to a recorder may also allow an attacker to change configurations, interfere with monitoring or create persistent access through additional accounts.
The wider concern is network exposure. Surveillance devices are often deployed across offices, warehouses, hospitals, retail sites, industrial facilities and public infrastructure. They may operate on networks that have not been adequately separated from corporate systems.
A camera that can communicate freely with other internal devices may give an attacker opportunities beyond the surveillance system itself. The actual consequences depend on the network design, device privileges and the attacker’s level of access; the reported incidents do not establish that every compromised camera led to a broader network intrusion.
For organizations across the Middle East and Africa, the warning is relevant to smart-city projects, commercial buildings, transportation facilities, government sites and industrial environments that rely on connected surveillance equipment. Security teams should review these systems as part of their wider cybersecurity and network security programme, rather than treating them as isolated physical-security equipment.
The issue is global, however, and is not limited to any one region or industry.
Ten Actions to Secure Dahua Cameras and Recorders
Organizations using Dahua surveillance equipment should review their deployments and take the following steps.
- Disable P2P/Easy4IP when it is not required. Turn off cloud access on devices that do not need remote connectivity. This reduces exposure through the relay service.
- Use a VPN for remote administration. Where remote access is necessary, prefer a controlled VPN connection with access restricted to authorized users and devices. Avoid exposing camera management interfaces directly to the internet.
- Review all user accounts. Check local accounts and associated cloud accounts for unknown users, unexpected privileges or accounts that are no longer needed. Remove unauthorized accounts and revoke unfamiliar cloud associations.
- Change default and weak passwords. Set strong, unique credentials for every device and account. Avoid reusing administrator passwords across cameras, recorders and other infrastructure.
- Update firmware manually. Check the manufacturer’s official support resources for the correct firmware for each model and hardware revision. Do not rely solely on an automatic update feature or a message stating that no update is available.
- Review audit logs and configuration changes. Investigate unfamiliar authentication events, unexpected account creation, unexplained settings changes and suspicious use of DVRIP. Preserve evidence before making changes that could destroy useful forensic information.
- Segment surveillance networks. Place cameras and recorders on dedicated network segments and restrict communication with corporate, server and operational technology environments to what is genuinely necessary.
- Restrict outbound connectivity. Review whether cameras and recorders need to communicate with external cloud services. Where P2P is not required, block the relevant outbound connections in line with vendor guidance and validate that the feature cannot be inadvertently re-enabled.
- Establish a regular security review. Maintain an inventory of models, firmware versions, network locations and responsible owners. Include surveillance equipment in vulnerability assessments and patch-management schedules.
- Prepare for compromise and train relevant staff. Document how to isolate affected devices, preserve evidence, reset credentials and restore secure configurations. Provide appropriate cybersecurity training and awareness for IT teams, surveillance administrators and security personnel.
These measures complement one another. Disabling unnecessary P2P access reduces the remote attack surface, while firmware updates, strong credentials, segmentation and monitoring help address other potential routes to compromise.
The Bigger Lesson: Cloud Convenience Needs Security Controls
The Easy4IP case illustrates a broader challenge for connected devices. Cloud-based access features can make installation and day-to-day management much easier, particularly for organizations with cameras deployed across multiple locations. But they also introduce dependencies and access paths that traditional network diagrams may not capture.
ITRES Labs’ research is especially useful because it connects the technical findings to a real incident investigation. Its work also highlights the importance of verifying firmware independently and understanding how security behavior differs across device generations.
Organizations should not assume that every Dahua camera is vulnerable in the same way, nor that every P2P-enabled device has been compromised. Equally, they should not treat the absence of publicly exposed ports as proof that a device is secure.
The right response is to establish which devices are deployed, determine how remote access is configured, verify the firmware and investigate signs of unauthorized activity.
Final Thoughts
CERT-UA’s warning and ITRES Labs’ research show why video surveillance infrastructure deserves the same disciplined security management as other connected IT systems.
Attackers may be able to reach some Dahua cameras and recorders through cloud-relay mechanisms even when conventional inbound access is blocked. Weak credentials, outdated firmware and poorly controlled administrative access can increase the risk.
Organizations should disable unnecessary P2P functionality, verify firmware through official sources, remove unauthorized accounts and restrict access to surveillance networks. Where a compromise is suspected, they should investigate before assuming that a password change alone has resolved the problem.
For businesses and public-sector organizations, securing surveillance equipment is part of protecting both physical security and the wider digital environment.
For further guidance on cybersecurity services and security awareness, organizations can review the resources available from Saintynet Cybersecurity. Readers can also explore related threat research and security reporting at Cybercory.com.
Stay informed. Stay secure.
Sources
- CERT-UA / State Service of Special Communications and Information Protection of Ukraine: Hackers May Gain Control of Cameras and Video Recorders Through Cloud Access.
- ITRES Labs, October 29, 2025: Beyond CVE-2025-31702: P2P Relay Exposure and Auto-Update Mismatches (Part II).
- Dahua Wiki: Easy4IP — Viewing Devices Through P2P.
- ITRES Labs, October 15, 2025: CVE-2025-31702: What a DFIR on Dahua Devices Taught Us.
