CERT-UA, Ukraine's computer emergency response team, said late last week that hackers have compromised internet-connected Dahua cameras and video recorders, changed their settings and created unauthorized user accounts, according to The Record (26 October 2026). The agency did not say how many devices were affected, when the intrusions happened, or who is responsible. It said the attackers appear to be abusing Easy4IP, a Dahua feature that links devices outward to the manufacturer's cloud using serial numbers, even behind firewalls. The warning is a useful test of what 'cross-border data flow' means in practice. The risk is a cloud rendezvous service that lets anyone who can guess an identifier reach a camera inside a network that looked closed.
The strongest case for a ban
The case for stripping Chinese-made surveillance gear from sensitive sites is serious. Ukraine is at war, and cameras are military sensors whether or not their owners intend it. RFE/RL's Schemes investigation (8 February 2024) reported the Interior Ministry's figure that Hikvision and Dahua systems make up 74 percent of the CCTV systems in Ukraine's national video-surveillance system, with another 24,000 of their cameras in similar public systems. The Record adds that Ukraine's security service said Russian intelligence hacked two Kyiv residential cameras in January 2024 to observe air defences, and that government bodies and military units kept buying Dahua equipment in 2026. A procurement rule that treats a vendor with a cloud back-channel as a possible collection point is a reasonable reading of that record.
What the evidence actually shows
The evidence points to a narrower, fixable defect. CERT-UA flagged CVE-2021-33044 and CVE-2021-33045. The US National Vulnerability Database describes both as identity authentication bypasses that let an attacker log in by sending crafted packets, published 15 September 2021 and scored 9.8 (critical). The second carries the same score. NVD records that CISA added both to its Known Exploited Vulnerabilities catalogue on 21 August 2024. These are five-year-old flaws with a patch. The compromise comes from running unpatched firmware on devices that can be reached from outside.
The Easy4IP angle is where the cross-border question becomes concrete. CERT-UA says serial numbers follow predictable patterns, so attackers can guess them in bulk and find cloud-connected cameras. Devices with the feature enabled can be exposed even if their serial numbers were never published. Hunt.io's Operation CameraSwarm report, published 18 August, documents a similar technique. One operator compromised more than 14,500 Dahua cameras in 35 days from 17 June, concentrated in Ukraine and Russia. Brute force of the port 37777 service hit 12,324 unique IPs. An exploit chain for the two CVEs left a persistent backdoor account on 1,923 cameras. A relay-by-serial-number path reached another 283 cameras that sat behind NAT. Hunt.io's own code analysis found that 89.4 percent of live serials returned an open channel requiring no authentication. Hunt.io says it is unclear whether the CERT-UA cases are connected to this campaign, and I make no claim that they are.
None of this requires the vendor to be malicious. In Hunt.io's account, the relay was reachable using credentials embedded in every Dahua client, so the problem sat in the access design. A vendor relay that works without authentication is a flaw whether the company is Chinese, American or Korean. Yet the same design creates the policy problem. Video, device metadata and a persistent outbound connection to infrastructure outside the owner's control are a data flow the owner often never chose.
Why a blanket ban is the wrong first move
A ban sounds decisive, but Ukraine has tens of thousands of installed cameras it cannot replace in wartime. Rip-and-replace is slow and costly, and the cheaper substitutes a municipality can afford may have the same weaknesses. A prohibition also invites a false sense of closure: the 2024 incidents involved cameras that were hacked, not cameras whose vendor handed over data. Controls aimed at the mechanism work faster and cost less.
- Disable P2P and cloud relay by default. Hunt.io's guidance is to turn off P2P unless it is actively needed, and to block port 37777 from outside the perimeter. For any camera with a view of infrastructure, that should be a baseline requirement.
- Patch known exploited flaws. The fix for both CVEs is Dahua's SA-2021-0130, per Hunt.io. Public bodies can require firmware currency as a condition of operating networked cameras.
- Procure on data-flow disclosure. Tenders should require vendors to document every outbound connection, what it carries, where it terminates, and how to disable it. Equipment that cannot be run in a local-only mode should not be bought for critical sites.
- Audit what is already deployed. Check for unknown accounts, as Hunt.io's guidance for the p2pwn backdoor account suggests, and treat any camera exposed on the internet during summer 2026 as potentially compromised.
This approach is proportionate. It targets the behaviour that creates exposure, keeps device-level security innovation open to any vendor that can meet it, and avoids a blunt origin-based rule that would be hard to enforce across thousands of small buyers. It also scales: the same disclosure and local-only requirements apply to every connected device that phones home, including routers, doorbells and building systems.
What remains unknown
CERT-UA's public warning leaves open how many devices were hit and whether any belong to government or military users; The Record says this is unclear. Until that is known, it is premature to say the intrusions were state-directed or to claim the vendor's cloud itself was breached. What the record does support is that remote-access features designed for convenience have been turned into reconnaissance infrastructure in a country where footage can inform targeting. The remedy is to treat the vendor relay as an attack surface that must be opted into, not assumed.