Critical Security Gap Persists as Tens of Thousands of Hikvision Cameras Remain Vulnerable to Year-Old Exploit

The global cybersecurity landscape is currently facing a significant and avoidable crisis as new research reveals that more than 80,000 Hikvision surveillance cameras remain unpatched against a critical vulnerability discovered nearly a year ago. Despite the issuance of a fix in September 2021, a staggering number of devices belonging to thousands of organizations across 100 countries continue to operate with a flaw that allows for unauthenticated remote code execution. This negligence has created a massive attack surface for state-sponsored threat actors and cybercriminal syndicates, particularly as evidence emerges of hackers collaborating on the dark web to exploit these specific weaknesses.

The vulnerability, tracked as CVE-2021-36260, was first brought to light by security researchers in late 2021 and was immediately recognized for its severity. The National Institute of Standards and Technology (NIST) assigned the exploit a Common Vulnerability Scoring System (CVSS) rating of 9.8 out of 10, categorizing it as "critical." This rating reflects the ease with which an attacker can gain full control over a device without requiring any user interaction or administrative credentials. For Hikvision, a Chinese state-owned entity and the world’s largest manufacturer of video surveillance equipment, the persistence of this flaw represents a systemic failure in the maintenance of global IoT infrastructure.

Technical Analysis of CVE-2021-36260

At its core, CVE-2021-36260 is a command injection vulnerability. It exists in the web server of certain Hikvision products, where insufficient input validation allows an attacker to send specially crafted messages to the affected device. Because the vulnerability resides in the pre-authentication layer, an attacker does not need to know the camera’s username or password to compromise it.

Once the command is injected, the attacker can execute arbitrary code with root privileges. In the context of a surveillance camera, this means an adversary could view live feeds, disable recording, access stored footage, or use the camera as a pivot point to move laterally into the victim’s broader corporate or government network. Because many of these cameras are connected to sensitive internal systems, a compromised camera often serves as a "beachhead" for more extensive data breaches or ransomware deployments.

The technical simplicity of the exploit, combined with the high privileges granted upon success, makes it an ideal tool for automated scanning and mass exploitation. Tools such as Shodan and Censys—search engines for Internet-connected devices—allow even low-skilled attackers to identify vulnerable Hikvision hardware in seconds.

Chronology of the Vulnerability and Response

The timeline of CVE-2021-36260 highlights a troubling gap between the availability of security patches and their actual implementation by end-users and administrators.

• June 2021: A security researcher identifies a critical command injection flaw in the firmware of various Hikvision camera models.
• September 2021: Hikvision officially acknowledges the vulnerability and releases firmware updates for the affected models. Security advisories are issued globally, urging immediate patching.
• October 2021: Security firms begin detecting active scanning for the vulnerability. Proof-of-concept (PoC) code is released publicly, lowering the barrier to entry for attackers.
• December 2021: Reports surface of the Mirai botnet incorporating the Hikvision exploit to enlist cameras into massive Distributed Denial of Service (DDoS) networks.
• August 2022: Research from cybersecurity firm Cyfirma reveals that over 80,000 devices across 2,300 organizations remain unpatched and exposed to the internet, nearly a year after the fix was made available.

This chronology suggests that while the manufacturer fulfilled its duty by providing a patch, the "last mile" of security—installation by the user—has failed on a global scale.

The Global Distribution of Risk

The Cyfirma report provides a granular look at where these vulnerable devices are located. Despite a 2019 decision by the U.S. Federal Communications Commission (FCC) to label Hikvision an "unacceptable risk to U.S. national security," thousands of the vulnerable units are still active within the United States. However, the problem is truly international.

The highest concentrations of unpatched cameras were found in Vietnam, the United Kingdom, Brazil, and the United States. The sectors affected range from small businesses and residential setups to critical infrastructure and government agencies. The presence of these cameras in the UK and US is particularly noteworthy given the ongoing geopolitical tensions regarding Chinese-made telecommunications and surveillance hardware.

In many cases, organizations may not even realize they are using Hikvision hardware. Hikvision acts as an Original Equipment Manufacturer (OEM) for dozens of other brands. This means a camera branded under a different name might actually contain Hikvision internals and software, leading to a "hidden" supply chain risk where administrators are unaware that Hikvision-specific patches apply to their systems.

Threat Actor Activity and Dark Web Exploitation

The persistence of CVE-2021-36260 has not gone unnoticed by the criminal underground. Researchers have identified multiple instances on Russian-language dark web forums where threat actors are actively trading information and collaborating on exploit strategies for Hikvision devices.

These forums have become marketplaces for leaked credentials. Even if a camera is patched against the command injection flaw, many remain vulnerable due to the use of default or weak passwords. Cybercriminals often sell "lists" of IP addresses and corresponding login credentials for compromised cameras, allowing buyers to monitor private locations or use the devices for botnet activity.

Beyond common cybercriminals, the vulnerability attracts advanced persistent threat (APT) groups. Cybersecurity analysts speculate that Chinese-linked groups, such as APT41 (also known as MISSION2025) and APT10, could leverage these vulnerabilities for espionage. Given Hikvision’s state-owned status, there are long-standing concerns that the hardware could be used for intelligence gathering. Similarly, Russian-affiliated groups have shown a keen interest in IoT vulnerabilities to facilitate disruptive operations against Western interests.

The Endemic Challenges of IoT Security

The Hikvision crisis underscores a broader, systemic issue within the Internet of Things (IoT) industry. Unlike modern operating systems like Windows, macOS, or mobile platforms like iOS and Android, IoT devices often lack automated update mechanisms.

David Maynor, a senior director of threat intelligence at Cybrary, notes that Hikvision cameras are particularly problematic because they offer no easy way to perform digital forensics. Once a camera is compromised, it is difficult for an administrator to verify that the attacker has been removed, even after a patch is applied. The "set it and forget it" mentality common in the surveillance industry means that once a camera is mounted on a wall, its software is rarely, if ever, updated.

Paul Bischoff, a privacy advocate with Comparitech, points out that the user interface for these devices is often clunky and unintuitive. "Updates are not automatic; users need to manually download and install them, and many users might never get the message," Bischoff stated. Furthermore, the lack of visual indicators—such as a notification light or an on-screen alert—means a camera can remain compromised for years without the owner ever suspecting a breach.

The reliance on default credentials exacerbates the issue. Many Hikvision devices ship with simple, predetermined passwords. If a user fails to change these during the initial setup, the device remains an open door for anyone with the IP address.

Geopolitical and Regulatory Implications

The continued presence of vulnerable Hikvision cameras has significant geopolitical ramifications. In the United States, the regulatory environment has turned sharply against Chinese surveillance firms. Following the 2019 FCC "Covered List" designation, the U.S. government passed the Secure Equipment Act of 2021, which effectively prevents the FCC from reviewing or issuing new equipment licenses to companies deemed national security threats.

The concern is twofold: first, the potential for "backdoors" that could allow the Chinese government to access sensitive video data; and second, the inherent security flaws like CVE-2021-36260 that allow third-party hackers to hijack the devices. For government contractors and critical infrastructure operators, the discovery of 80,000 unpatched devices is a stark reminder of the difficulty of purging "untrusted" technology from complex networks.

In Europe and other regions, the debate is evolving similarly. Regulators are increasingly looking at "Security by Design" mandates that would require IoT manufacturers to include automatic updates and ban the use of universal default passwords.

Recommendations for Mitigation

For organizations and individuals currently utilizing Hikvision equipment, cybersecurity experts recommend a multi-layered approach to mitigation:

1. Immediate Firmware Audit: Administrators must identify every Hikvision device (including OEM-rebranded units) on their network and verify the firmware version. Any device running firmware older than the September 2021 release must be updated immediately.
2. Network Segmentation: Surveillance cameras should never be exposed directly to the public internet. They should be placed on a segregated VLAN (Virtual Local Area Network) with strict firewall rules that limit communication only to authorized recording servers or management consoles.
3. Credential Management: Default passwords must be changed to complex, unique strings. Where supported, multi-factor authentication (MFA) should be implemented for accessing the management interface.
4. IP Whitelisting: If remote access is required, it should be facilitated through a secure VPN rather than port forwarding. Access to the camera’s web interface should be restricted to a specific list of known IP addresses.
5. Decommissioning Legacy Gear: For devices that are "End of Life" (EOL) and no longer receive security updates, the only secure course of action is to decommission the hardware and replace it with supported, secure alternatives.

The situation surrounding Hikvision cameras is a cautionary tale for the digital age. It demonstrates that the discovery and patching of a vulnerability is only half the battle. Without a concerted effort to improve the "hygiene" of IoT maintenance, the world’s surveillance infrastructure will remain a playground for opportunists and state-sponsored adversaries alike. The fact that 80,000 cameras remain open to a well-known, year-old exploit is not just a technical failure, but a significant oversight in global risk management.