Skip to content
securitytabs

LiveUpdated

Ukraine's CERT-UA warns of attackers taking over Dahua cameras and video recorders

Ukraine's cyber incident response team says hackers have taken over internet-connected Dahua security cameras and video recorders, viewing footage and changing settings. Organizations using these devices should check them; no fix has been reported yet.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

CERT-UA, Ukraine's computer emergency response team, says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts, according to The Record. [1]

The Hacker News reports that CERT-UA's alert describes cases of compromised IP cameras and digital video recorders (DVRs) with access to the video stream, changed device configuration and third-party accounts. Security Affairs says the alert is dated October 23, 2026. [2][3]

How the access was gained

Security Affairs reports that attackers can remotely access the devices through Easy4IP, a Dahua remote-access feature, to view video and change settings. The Hacker News headline refers to peer-to-peer (P2P) access and authentication weaknesses. The excerpts available do not name a specific vulnerability or identify who is behind the activity. [3][2]

What is not yet known

The coverage reviewed does not give the number of affected devices, affected models, a patch, or indicators of compromise. No CVE identifiers are associated with the story. [1][2][3]

Timeline

  1. The Hacker News and Security Affairs reported details of the alert, including Easy4IP and P2P access. [2][3]

  2. The Record reported CERT-UA's warning that hackers were exploiting Dahua cameras. [1]

  3. CERT-UA issued an alert about unauthorized remote access to Dahua cameras and video recorders. [3]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your business uses Dahua cameras or video recorders, attackers have been reported viewing footage and changing settings. No fix or indicators have been published in the coverage so far. [1][3]

What to do

  1. Ask whoever installed your cameras whether they are Dahua devices and whether remote access features such as Easy4IP are enabled. [3]
  2. Look at each device's user list for accounts you did not create, since CERT-UA reports unauthorized accounts were added. [1][2]

Mid-size company

A small IT or security team

What to know

CERT-UA reports changed configurations and unauthorized accounts on Dahua cameras and recorders. No patch or published indicators are cited in the coverage, so confirming exposure rests on your own inventory. [1][2]

What to do

  1. Inventory Dahua cameras and recorders and identify which have Easy4IP or P2P remote access enabled. [3][2]
  2. Review device settings and user accounts for changes you did not make, as described in the CERT-UA alert. [1][2]
  3. Watch Dahua and CERT-UA for advisories and fixes. [2]

Large enterprise

A security operations team

What to know

CERT-UA reports compromises of Dahua IP cameras and DVRs through remote-access features, with configuration changes and added accounts. The outlets do not name a vulnerability, affected models or indicators. [1][2][3]

What to do

  1. Inventory Dahua devices at scale and identify those reachable through Easy4IP or P2P services. [3][2]
  2. Audit device configurations and local accounts for unauthorized changes and investigate any found as potential incidents. [1][2]
  3. Monitor CERT-UA and Dahua for published indicators and fixes. [2]

Sources

  1. [1]The Record · Oct 26, 14:21 UTC
    Ukraine warns hackers are exploiting Chinese-made Dahua surveillance camerascontext
  2. [2]The Hacker News · Oct 27, 06:34 UTC
    Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknessescontext
  3. [3]Security Affairs · Oct 27, 09:56 UTC
    Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IPcontext