CERT-UA warns hackers are exploiting Dahua cameras via Easy4IP

Ukraine's CERT-UA said attackers are gaining unauthorized access to Dahua cameras and video recorders, changing settings and creating rogue accounts. The attacks exploit the cloud-based Easy4IP feature with predictable serial numbers, weak passwords and flaws CVE-2021-33044 and CVE-2021-33045.

• CERT-UA did not disclose the number of compromised devices or the culprits
• Easy4IP connects cameras to the cloud by serial number, bypassing firewalls
• Attackers abuse flaws CVE-2021-33044 and CVE-2021-33045 from 2021
• Hunt.io reported over 14,500 compromised Dahua devices in August