Ukrainian CERT Warns of Remote Hijack of Dahua Cameras Through P2P Vulnerabilities

Ukraine’s Computer Emergency Response Team (CERT‑UA) issued a public advisory confirming that a number of Dahua IP cameras and digital video recorders (DVRs) are being accessed remotely without permission. The breach exploits the built‑in peer‑to‑peer (P2P) feature and known flaws in default authentication, enabling threat actors to view live streams and alter device settings.

The P2P capability, promoted as an easy method for users to watch camera feeds on smartphones or browsers without intricate network configuration, depends on cloud‑based relay servers and frequently arrives with default credentials. Researchers have repeatedly warned that absent strict password enforcement or simple disable options, the feature can serve as an open backdoor for attackers.

The CERT‑UA notice reports that hijacked devices have been seen sending video to unauthenticated destinations and permitting configuration modifications like firmware roll‑backs, resolution changes, and even the upload of malicious code. Consequently, an adversary can monitor critical sites, interfere with surveillance functions, or turn the cameras into footholds inside broader corporate or municipal networks.

Dahua hardware is extensively installed throughout Ukraine, covering public infrastructure—including transport hubs, government facilities, and utilities—as well as private sectors like retail outlets and residential complexes. The breadth of this vulnerability fuels worries about privacy violations and the possibility of organized surveillance operations amid heightened geopolitical strain.

To mitigate the risk, CERT‑UA urges operators to promptly replace all default passwords, turn off the P2P function when unnecessary, and install the newest firmware patches supplied by the vendor. It also suggests segmenting networks to separate video surveillance traffic from essential systems and to watch outbound connections for anomalous data transfers.

Analysts note that this incident highlights a wider pattern of cyber‑crime groups focusing on Internet of Things (IoT) devices with weak security measures. Although Dahua has not released an official comment, industry observers anticipate that the company will issue patches and may revamp its authentication process. Ongoing diligence by system administrators and collaborative information‑sharing among national CERTs will be essential to curb additional exploitation.