Ukraine's computer emergency response team, CERT-UA, has warned that attackers are gaining unauthorised access to surveillance cameras and video recorders made by the Chinese manufacturer Dahua, changing settings and creating their own user accounts. The vector is Easy4IP, a feature that exposes Dahua devices remotely through the manufacturer's cloud service by connecting them using their serial numbers — which means devices stay reachable even when firewall-protected or not directly internet-exposed. CERT-UA says the serial numbers follow predictable patterns, so an attacker can enumerate candidate serials and identify cloud-connected cameras even where those serials were never published; from there, weak or default passwords and outdated firmware do the rest. The agency specifically flagged CVE-2021-33044 and CVE-2021-33045, both disclosed in 2021, as authentication bypasses still in use against certain models. CERT-UA did not state how many devices were affected, when the attacks occurred or who was responsible. The warning lands in a wartime context in which Ukraine's SBU has secured roughly 40,000 surveillance cameras since 2022, and Chinese-made equipment remains in wide use by Ukrainian government institutions and military units.

• Source article