CERT-UA Warns of Active Exploitation of Dahua IP Cameras and DVRs in Ukraine

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP) reported. The advisory attributes the activity to threat actors exploiting P2P access mechanisms and authentication weaknesses to gain unauthorized remote control of Dahua IP cameras and DVRs. Recorded impacts include unauthorized access to live video streams, changes to device configuration, and the provisioning of third-party accounts on affected systems. The alert was issued on 2026-10-27 and confirmed by SSSCIP. No specific CVE numbers or firmware versions were disclosed in the initial reporting. The advisory does not attribute the activity to a specific threat actor or group. CERT-UA and SSSCIP recommend that operators of Dahua surveillance equipment disable unnecessary remote access, update firmware to the latest available version, and enforce strong, unique credentials on affected devices. The full scope of compromised devices and any potential data exfiltration remain under investigation.