Ukrainian cybersecurity experts have identified cases of compromised surveillance cameras and video recorders manufactured by the Chinese company Dahua. Attackers have gained access to video feeds, altered device settings, and created unauthorized user accounts, potentially posing a threat to Ukraine’s military facilities and critical infrastructure.
Ukraine’s Computer Emergency Response Team, CERT-UA, has reported cases of compromised Dahua IP cameras and video recorders. During the reported incidents, attackers managed to access live video feeds, modify device configurations, and create unauthorized user accounts to maintain control over the equipment.
CERT-UA confirmed:
“Cases of compromised IP cameras and video recorders have been recorded, involving access to video streams, changes to device configurations, and the creation of unauthorized user accounts.”
It remains unclear exactly how many devices have been compromised, when the attacks occurred, or who was responsible. Meanwhile, surveillance equipment manufactured by Chinese companies is widely used in Ukraine, including in the military sector. One of the biggest concerns is the possibility that Russian intelligence services could exploit compromised cameras, as access to surveillance footage could potentially allow them to track Ukrainian military movements, monitor strategic facilities, and gather intelligence on critical infrastructure.
According to CERT-UA, one possible method of identifying and subsequently compromising these devices involves exploiting the Easy4IP cloud feature. This function allows Dahua camera owners to connect to their equipment remotely through the manufacturer’s cloud service, even when the device is behind a firewall or is not directly accessible from the internet. Easy4IP uses a device’s serial number to establish a connection, but researchers have pointed out that these numbers follow a predictable structure that attackers could exploit.
Researchers believe attackers may be able to automatically generate large numbers of potential serial numbers and check whether the corresponding devices exist within Dahua’s cloud infrastructure.
CERT-UA explained:
“Serial numbers have a predictable structure and are likely obtained by attackers through brute-force enumeration, followed by verification of whether the corresponding device exists in the cloud.”
As a result, even a camera that is not directly exposed to the internet can potentially be discovered through the cloud service if Easy4IP is enabled. Experts emphasize that the risk applies to all devices using this remote access mechanism.
“Therefore, all devices with the Easy4IP feature enabled are at risk. Assuming that a device’s serial number is unknown to others is not a valid reason to consider the device secure.”
However, knowing a device’s serial number does not automatically mean an attacker has gained full control over the camera. It helps identify the equipment and creates opportunities for subsequent stages of an attack. Once a device has been discovered, attackers may attempt to gain access using default or weak passwords. Another possible scenario involves exploiting vulnerabilities in outdated firmware versions that allow authentication mechanisms to be bypassed.
CERT-UA also highlighted two critical vulnerabilities discovered back in 2021. These are CVE-2021-33044 and CVE-2021-33045, which affect certain models of Dahua IP cameras and video recorders. Both vulnerabilities involve the possibility of bypassing authentication. Under certain conditions, an attacker can craft specially designed network packets that bypass identity verification when communicating with a vulnerable device.
The combination of several factors poses a particularly serious threat: enabled cloud access, predictable serial numbers, weak passwords, and outdated software. In such cases, attackers may first identify a camera and then exploit weaknesses in its security.
The problem is not new. In 2024, the US Cybersecurity and Infrastructure Security Agency (CISA) warned about the active exploitation of these vulnerabilities and added them to its Known Exploited Vulnerabilities Catalog. The agency noted that the flaws could allow attackers to bypass authentication mechanisms in Dahua IP cameras and related equipment, making vulnerable devices potential targets even without knowing the owner’s login credentials.
However, the existence of these vulnerabilities does not mean that every camera compromise recorded in Ukraine involved their exploitation. CERT-UA considers them additional risks for equipment that has not received the necessary security updates.
Dahua is one of China’s largest manufacturers of video surveillance systems. The company supplies IP cameras, video recorders, and other security equipment to numerous countries worldwide. However, its products have previously faced restrictions due to national security and human rights concerns.
In November 2022, the US Federal Communications Commission (FCC) introduced restrictions on the authorization of certain telecommunications and video surveillance equipment manufactured by Chinese companies. The list of manufacturers whose products US authorities consider potential national security risks included Huawei, ZTE, Hytera, Hikvision, and Dahua.
For Ukraine, the risks associated with vulnerable surveillance equipment are particularly significant because of Russia’s full-scale invasion. If unauthorized parties gain access to cameras near military positions, logistics routes, or critical infrastructure facilities, the video feeds could become a source of intelligence. However, the confirmed compromises do not establish the involvement of any particular state or hacking group. Ukrainian cybersecurity experts have not yet identified those responsible for the attacks.
The incidents demonstrate that cloud-based remote access features can introduce additional security risks to surveillance systems, especially when devices use weak passwords or outdated firmware. Dahua camera owners should review whether Easy4IP is necessary, install available security updates, replace default passwords, and check for unauthorized user accounts.
Since the exact number of compromised devices remains unknown, particular attention should be paid to cameras installed near military facilities and critical infrastructure, where unauthorized access to video feeds could have the most serious consequences.
