Ukrainian CERT Warns of Remote Hijack of Dahua Cameras Through P2P Vulnerabilities

The Ukrainian Computer Emergency Response Team (CERT‑UA) has issued a public alert after verifying that a number of Dahua‑branded IP cameras and digital video recorders (DVRs) are being accessed remotely without permission. The breach exploits the devices' built‑in peer‑to‑peer (P2P) feature and known flaws in default authentication, permitting attackers to view live feeds and alter hardware settings.

P2P capability, promoted as an easy way for users to watch camera streams on smartphones or browsers without intricate network configuration, depends on cloud‑based relay services and often ships with factory‑set credentials. Researchers have long warned that when manufacturers fail to enforce strong passwords or provide a simple way to turn the feature off, it can serve as an open backdoor for malicious actors.

The CERT‑UA bulletin notes that compromised units have been seen streaming video to unauthenticated destinations and accepting configuration changes such as firmware roll‑backs, resolution tweaks, and even the injection of malicious code. In effect, an adversary can monitor sensitive sites, disrupt surveillance operations, or use the cameras as entry points into larger corporate or municipal networks.

Dahua hardware is extensively installed throughout Ukraine, covering public infrastructure—including transport hubs, government facilities, and utilities—as well as private sectors like retail outlets and residential complexes. This breadth of exposure fuels worries over privacy violations and the possibility of coordinated surveillance drives amid heightened geopolitical tensions.

To counter the threat, CERT‑UA urges operators to promptly replace all default passwords, deactivate the P2P service when it is not required, and install the newest firmware updates supplied by the vendor. The agency also recommends segmenting networks to isolate video‑surveillance traffic from critical systems and watching outbound connections for anomalous data transfers.

Analysts say the incident highlights a wider pattern of cyber‑crime groups targeting Internet of Things (IoT) devices lacking solid security measures. While Dahua has not released an official comment, industry experts anticipate that the company will roll out patches and possibly revamp its authentication process. Ongoing vigilance by system administrators and coordinated information‑sharing among national CERTs will be essential to prevent further exploitation.