Over 80,000 Hikvision Surveillance Cameras Remain Vulnerable to Critical Unpatched Flaw Nearly a Year After Disclosure

Nearly a year after the disclosure of a critical security vulnerability affecting widely used video surveillance equipment, more than 80,000 Hikvision cameras worldwide remain unpatched, exposing thousands of organizations to remote compromise. The flaw, tracked as CVE-2021-36260, is a severe command injection vulnerability that carries a maximum severity rating of 9.8 out of 10 on the National Vulnerability Database (NVD) scale managed by the National Institute of Standards and Technology (NIST).

Recent intelligence reports highlight that despite the availability of a firmware update from the manufacturer since late 2021, a massive global footprint of these devices continues to operate with the flaw exposed. Threat actors, including sophisticated advanced persistent threat (APT) groups and cybercriminals operating on Russian-language dark web forums, have been actively collaborating to exploit these unsecured endpoints. The situation has reignited intense scrutiny regarding the cybersecurity posture of the Internet of Things (IoT) manufacturing sector, corporate patching discipline, and the geopolitical risks associated with ubiquitous surveillance infrastructure.

Anatomy of CVE-2021-36260 and the Threat Landscape

The vulnerability stems from improper input validation in the web server module of various Hikvision camera models. Specifically, CVE-2021-36260 allows an unauthenticated remote attacker to execute arbitrary commands on the affected device by sending crafted messages with malicious payloads to the web server. Because network cameras often sit at the perimeter of an organization’s network perimeter—frequently directly exposed to the public-facing internet to allow remote viewing by operators—a successful exploit grants the attacker full root access to the underlying Linux operating system running on the camera.

Once inside the device, malicious actors can leverage the compromised camera as a secure foothold or pivot point to move laterally deeper into corporate, industrial, or government networks. Furthermore, bad actors can intercept video feeds, alter surveillance logs, deploy botnet malware, or disable security monitoring entirely without the knowledge of the system administrators.

Cybersecurity researchers examining underground forums have noted a significant uptick in interest surrounding this specific vulnerability. Threat actors have been observed discussing exploitation methodologies, sharing scripts, and even trading or selling compromised camera credentials harvested via automated scanning tools. This monetization of IoT vulnerabilities lowers the technical barrier to entry, allowing lower-tier cybercriminals to leverage exploits previously reserved for sophisticated state-sponsored hackers.

Chronology of the Vulnerability

To understand the scale of the current exposure, it is necessary to examine the timeline of events surrounding the discovery, disclosure, and remediation efforts for CVE-2021-36260.

• September 2021: Security researcher "FishWang" publicly discloses the command injection vulnerability affecting a wide range of Hikvision IP cameras. Shortly thereafter, NIST assigns the identifier CVE-2021-36260 and rates it a critical 9.8 out of 10.
• Late September 2021: Hikvision acknowledges the vulnerability and releases official firmware updates designed to patch the flaw across all impacted device series. Advisories are distributed to integrators and end-users urging immediate updates.
• Late 2021 to Early 2022: Despite vendor advisories, adoption of the firmware patch lags significantly. Automated scanning engines, such as Shodan and Censys, reveal that hundreds of thousands of devices remain accessible from the public internet with outdated firmware.
• Mid 2022: Threat intelligence reports, including comprehensive studies by firms such as Cyfirma, indicate that over 80,000 unique Hikvision cameras remain unpatched globally. Evidence emerges of active discussions on Russian dark web forums detailing how to weaponize the vulnerability en masse.
• Present Day: The vulnerability persists across numerous enterprise networks, municipal systems, and residential setups, highlighting a systemic failure in IoT maintenance and vulnerability management lifecycles.

Geopolitical Implications and State-Sponsored Interest

Hangzhou Hikvision Digital Technology Co., Ltd., commonly known as Hikvision, is a partially state-owned Chinese manufacturer of video surveillance hardware and software solutions. Its products are deployed across more than 100 countries, monitoring everything from critical national infrastructure and transportation hubs to commercial enterprises and private residences.

The widespread global deployment of Hikvision equipment has long been a subject of international security debates. In 2019, the United States Federal Communications Commission (FCC) designated Hikvision as "an unacceptable risk to U.S. national security," citing concerns over data privacy, state influence, and potential intelligence-gathering capabilities. Similar concerns have been raised by regulators in other Western nations, leading to bans or restrictions on the procurement of government surveillance equipment from specific foreign manufacturers.

Given the geopolitical sensitivity of Hikvision’s ownership structure, security analysts express concern over who may be capitalizing on the unpatched devices. While cybercriminals seek financial gain through ransomware or corporate espionage, state-backed threat actors maintain broader strategic objectives. Intelligence analysts suggest that Chinese state-sponsored groups—such as those tracked as APT41 or MISSION2025—alongside Russian threat syndicates, could potentially exploit these vulnerabilities to conduct long-term surveillance, map critical infrastructure, or establish clandestine intelligence-gathering networks across geopolitical adversaries. While definitive attribution remains difficult due to the obfuscated nature of cyber attacks, the strategic value of thousands of globally distributed, compromise-ready camera feeds is undeniable.

Systemic Vulnerabilities within the IoT Ecosystem

The persistence of CVE-2021-36260 nearly a year after its disclosure cannot be attributed solely to end-user negligence. Industry experts point to foundational flaws in how Internet of Things devices are engineered, deployed, and maintained.

David Maynor, senior director of threat intelligence at Cybrary, emphasizes that Hikvision hardware has historically suffered from systemic security deficiencies. "Their product contains easy-to-exploit systemic vulnerabilities or, worse, uses default credentials," Maynor explains. Furthermore, he notes structural limitations that complicate incident response: "There is no good way to perform forensics or verify that an attacker has been excised. Furthermore, we have not observed any change in Hikvision’s posture to signal an increase in security within their development cycle."

Unlike traditional computing environments where automated patch management tools are standard, IoT devices present unique operational hurdles. Paul Bischoff, a privacy advocate with Comparitech, highlights the inherent friction in securing hardware endpoints.

"IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff notes in an email statement. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date. Whereas your phone will alert you when an update is available and likely install it automatically the next time you reboot, IoT devices do not offer such conveniences."

Compounding these architectural challenges is human behavior. Many organizations and consumers install surveillance cameras and leave them operating on default factory configurations for years. Default usernames and predetermined passwords—often documented publicly online—allow attackers to bypass authentication entirely without even needing to execute sophisticated software exploits. When combined with search engines designed to index connected hardware, cybercriminals can identify, catalog, and compromise vulnerable cameras in a matter of minutes.

Remediation and Mitigation Strategies

Securing legacy and modern IoT deployments against command injection flaws like CVE-2021-36260 requires a multi-layered defense strategy. Cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), recommend immediate remediation actions for any organization utilizing Hikvision equipment:

1. Apply Firmware Updates Immediately: Organizations must consult official vendor advisories, download the latest firmware patches corresponding to their specific hardware models, and apply updates across all operational devices.
2. Isolate IoT Devices on Segregated Networks: Cameras and other smart devices should never be placed on flat networks alongside critical servers or workstation domains. Implementing Virtual Local Area Networks (VLANs) and strict firewall rules ensures that if a camera is compromised, the blast radius is contained.
3. Eliminate Direct Exposure to the Public Internet: Cameras should not be directly accessible via public IP addresses. Organizations should mandate the use of secure Virtual Private Networks (VPNs) or zero-trust network access (ZTNA) solutions for remote administrative access and viewing.
4. Enforce Strong Authentication Policies: All default usernames and factory-set passwords must be changed immediately upon installation. Organizations should implement complex, unique passwords and, where supported, multi-factor authentication (MFA) for administrative accounts.
5. Continuous Asset Discovery and Monitoring: Security teams must maintain an accurate inventory of all connected IoT devices and utilize network monitoring tools to detect anomalous outbound traffic, unauthorized connection attempts, or unexpected behavioral changes in surveillance hardware.

As connected devices continue to proliferate across enterprise and municipal environments, the challenge of maintaining secure firmware baselines remains one of the most pressing hurdles in modern cybersecurity. Without a concerted shift toward automated updating mechanisms, stricter manufacturing standards, and proactive network segmentation, vulnerabilities like CVE-2021-36260 will continue to provide adversaries with an expansive and vulnerable global attack surface.