Ethical Hacking News
Unauthorized access to Dahua IP cameras using P2P access and authentication weaknesses has raised serious concerns about the security of these cameras. The attackers used a combination of credential brute-force attacks and the exploitation of vulnerabilities in outdated firmware versions to gain access to the cameras. The incident highlights the importance of network security and the need for organizations to take proactive measures to protect their systems and data.
Dahua's IP cameras have been compromised by attackers using a P2P access and authentication weakness. The vulnerability allowed attackers to gain unauthorized access to cameras, posing a significant threat to network security and personal data. The attackers exploited a predictable structure in Dahua's serial numbers, which allowed them to guess serial numbers and gain access to devices. The attackers used weak or known passwords, or exploited authentication bypass vulnerabilities to gain access to cameras. The attackers deployed a persistent backdoor account on nearly 2,000 cameras, which can survive password changes and factory resets. The incident highlights the importance of network security and the need for organizations to take proactive measures to protect their systems and data. The incident also underscores the need for manufacturers to prioritize security and implement robust measures to prevent vulnerabilities in their products.
Dahua, a well-known Chinese company that specializes in the manufacturing of IP cameras, has recently found itself at the center of a high-stakes cybersecurity battle. The company's IP cameras, which are used for a variety of purposes including surveillance, security, and monitoring, have been compromised by attackers using a peer-to-peer (P2P) access and authentication weakness. This vulnerability has allowed attackers to gain unauthorized access to these cameras, resulting in a significant threat to network security and personal data.
The incident, which was first reported by the Computer Emergency Response Team of Ukraine (CERT-UA), has raised serious concerns about the security of Dahua's IP cameras. According to CERT-UA, the primary initial access vector used by attackers was via Easy4IP, a P2P platform that allows users to remotely monitor homes or small businesses by connecting their Dahua IP cameras, NVRs, and DVRs via a smartphone app or web browser by scanning a QR code or entering the hardware Serial Number (SN).
The attackers took advantage of the fact that Dahua's serial numbers have a predictable structure, containing a 10-character model prefix that is identical for all units of the same device family and a five-character hexadecimal counter that is incremented almost sequentially. This allowed attackers to guess the serial numbers at scale through a brute-force attack and identify if they are connected to the cloud without hitting rate limits or lockouts. As a result, all devices with active P2P functionality are at risk even if they cannot be accessed directly via the internet.
Authentication barriers were overcome by leveraging weak or known passwords, or by exploiting authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. The attackers also used a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain to gain access to the cameras.
The attackers scanned for TCP port 37777, which is the default proprietary management and video streaming port used by Dahua, followed by collecting serial numbers, breaking into those devices by employing the aforementioned two exploitation methods, and then deploying a persistent backdoor account (p2pwn/p2password) on nearly 2,000 cameras in a manner that can survive password change and a factory reset.
The incident has highlighted the importance of network security and the need for organizations to take proactive measures to protect their systems and data. It has also underscored the need for manufacturers to prioritize security and implement robust measures to prevent vulnerabilities in their products.
In response to the incident, CERT-UA has advised users to disable the P2P feature if not required, avoid exposing them directly to the internet, and keep the software up-to-date. The agency has also shared indicators of compromise associated with the activity, including the presence of unknown accounts, unauthorized configuration changes, audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.
The incident has also raised concerns about the use of P2P access and authentication weaknesses in network security. The use of such weaknesses can allow attackers to gain unauthorized access to systems and data, resulting in a significant threat to network security and personal data.
In conclusion, the unauthorized access to Dahua IP cameras has highlighted the importance of network security and the need for organizations to take proactive measures to protect their systems and data. It has also underscored the need for manufacturers to prioritize security and implement robust measures to prevent vulnerabilities in their products.
Related Information:
https://www.ethicalhackingnews.com/articles/Unauthorized-Access-to-Dahua-IP-Cameras-A-Threat-to-Network-Security-and-Personal-Data-ehn.shtml
https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html
https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
Published: Tue Oct 27 02:37:50 2026 by llama3.2 3B Q4_K_M
