Over 80,000 Hikvision Surveillance Cameras Remain Vulnerable to Critical Unpatched Command Injection Flaw Nearly a Year Later

Nearly twelve months after cybersecurity authorities and researchers first disclosed a critical, highly severe vulnerability affecting tens of thousands of video surveillance units worldwide, over 80,000 internet-connected Hikvision cameras remain dangerously unpatched and exposed to malicious actors. The flaw, cataloged as CVE-2021-36260, carries a maximum severity score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), indicating an extreme risk that allows remote attackers to execute arbitrary commands without authentication.

Recent intelligence reports highlight that state-sponsored cyberespionage syndicates and financially motivated extortionists are actively scanning for these neglected devices. The ongoing exposure of these cameras not only highlights pervasive systemic vulnerabilities within the broader Internet of Things (IoT) manufacturing ecosystem, but it also underscores the profound difficulties organizations face when maintaining and securing physical security hardware connected to enterprise networks.

Background and Anatomy of CVE-2021-36260

The security flaw at the center of this ongoing global exposure resides within the web server component running on a vast array of Hikvision video surveillance products. Manufactured by Hangzhou Hikvision Digital Technology—a major Chinese state-owned enterprise providing video surveillance equipment to more than 100 countries—these cameras are deployed across critical infrastructure, commercial enterprises, government facilities, and residential properties.

CVE-2021-36260 is specifically classified as a command injection vulnerability. Due to improper input validation in the web management interface, an unauthenticated remote attacker can craft and transmit specially designed messages to the affected device. When processed, this malicious payload enables the execution of arbitrary commands directly on the underlying operating system of the camera with root-level privileges.

The ramifications of a root-level command injection are severe. An unauthorized individual who successfully exploits this vulnerability can gain total administrative control over the surveillance hardware. This grants the attacker the ability to intercept live video feeds, modify system configurations, disable recording functions, or utilize the compromised camera as an internal foothold to pivot deeper into the host organization’s corporate or operational network. Because surveillance cameras are frequently trusted devices situated behind corporate perimeters, a successful breach can bypass traditional perimeter defenses, exposing sensitive internal servers, intellectual property, and confidential communications.

Chronology of the Vulnerability

The lifecycle of CVE-2021-36260 features a timeline stretching from initial discovery to active exploitation and ongoing enterprise negligence:

• September 2021: Independent security researchers discover and privately disclose a severe command injection flaw in the web server of multiple Hikvision camera models.
• Late September 2021: Hikvision acknowledges the vulnerability and officially publishes CVE-2021-36260, simultaneously releasing urgent firmware patches designed to remediate the flaw. The National Vulnerability Database (NVD) evaluates the issue, assigning it a critical 9.8 CVSS score.
• Fall 2021 through Spring 2022: Despite widespread media coverage and alerts issued by cybersecurity agencies globally, adoption rates for the firmware update lag significantly. Automated threat scanners index vulnerable devices using search engines specialized in IoT discovery, such as Shodan and Censys.
• Summer 2022: Threat intelligence firms, including Cyfirma, publish comprehensive research revealing that over 80,000 instances of the vulnerable cameras remain exposed to the public internet. Furthermore, analysts observe threat actors on Russian dark web forums discussing collaboration strategies for exploiting the flaw, alongside the illicit sale of compromised camera credentials.
• Present Day: Tens of thousands of devices continue to operate on outdated, vulnerable firmware, leaving organizations exposed to automated botnets and targeted attacks.

Geopolitical Dimensions and Threat Actor Activity

The widespread deployment of Hikvision equipment has long been a subject of international scrutiny, extending far beyond software vulnerabilities. In 2019, the United States Federal Communications Commission (FCC) officially designated Hikvision as an entity presenting an unacceptable risk to U.S. national security, citing concerns regarding foreign intelligence gathering and proximity to the Chinese state apparatus. Despite such warnings and subsequent trade and procurement restrictions, millions of previously installed Hikvision units remain operational across Western economies.

The intersection of a critical unpatched vulnerability and the geopolitical profile of the manufacturer creates a complex threat landscape. Cyber threat intelligence analysts monitoring the situation have warned that advanced persistent threat (APT) groups could leverage these neglected attack surfaces. While definitive attribution for widespread exploitation remains challenging due to the stealthy nature of such operations, researchers point out that state-backed actors—including groups historically linked to Chinese and Russian intelligence operations—frequently scan for and stockpile zero-day and unpatched critical vulnerabilities.

Reports from dark web intelligence platforms indicate that unauthorized access to compromised Hikvision feeds and administrative dashboards is increasingly traded among cybercriminal underground syndicates. Whether the ultimate objective is intellectual property theft, corporate espionage, physical surveillance disruption, or the assembly of large-scale distributed denial-of-service (DDoS) botnets, the persistence of CVE-2021-36260 provides a low-effort, high-reward vector for malicious operators.

Systemic Vulnerabilities and the IoT Security Crisis

The failure of over 80,000 devices to receive critical security patches nearly a year after remediation became available cannot be attributed solely to administrative apathy. Industry experts emphasize that the incident reflects deep-seated structural challenges inherent to the design, deployment, and lifecycle management of Internet of Things (IoT) ecosystems.

David Maynor, senior director of threat intelligence at Cybrary, notes that Hikvision products have historically suffered from systemic security deficiencies. According to Maynor, these devices frequently incorporate easy-to-exploit architectural flaws and, in many cases, rely on hardcoded or default administrative credentials out of the box. Compounding these design weaknesses is a fundamental lack of robust forensic capabilities. If an organization’s Hikvision camera is compromised, security teams often lack the necessary logging, telemetry, or integrity-checking tools to verify whether an attacker has established persistence or successfully extracted sensitive data. Furthermore, critics argue that the manufacturer’s internal software development lifecycle has historically lacked the rigorous security posture required for hardware deployed in sensitive enterprise environments.

Beyond manufacturer-specific shortcomings, the broader IoT landscape suffers from stark usability and maintenance deficits when compared to traditional computing platforms. Paul Bischoff, a privacy advocate with Comparitech, highlights the fundamental friction involved in securing connected hardware. Unlike modern smartphones, operating systems, and desktop applications—which routinely notify users of pending updates and automate the patching process upon reboot—IoT devices rarely offer such streamlined conveniences.

Security updates for commercial surveillance cameras typically require manual intervention. Administrators must log into individual management consoles, download specific firmware images corresponding to exact hardware revisions, and carefully apply updates without disrupting ongoing physical security monitoring operations. In many organizations, physical security teams and IT departments operate in separate administrative silos, leading to critical oversight gaps where cameras are installed, connected to the network, and subsequently forgotten.

Compounding these administrative hurdles is the prevalent reliance on default configurations. Many users fail to alter factory-default usernames and passwords upon initial installation. When combined with automated scanning tools that continuously index vulnerable network endpoints, even minor security oversights can result in rapid, large-scale compromise.

Implications and Recommendations for Enterprise Security

The enduring exposure of tens of thousands of Hikvision cameras serves as an urgent cautionary tale for organizations navigating the convergence of physical security and corporate IT infrastructure. As physical security systems become increasingly digitized and network-connected, they expand the enterprise attack surface in ways that traditional security policies frequently fail to address.

To mitigate the risks posed by unpatched IoT hardware and vulnerabilities like CVE-2021-36260, cybersecurity professionals recommend adopting a comprehensive, defense-in-depth strategy specifically tailored for connected devices:

1. Asset Discovery and Inventory: Organizations must maintain an accurate, up-to-date inventory of all connected IoT and physical security devices across their networks. Utilizing specialized network discovery tools ensures that unauthorized or forgotten hardware is quickly identified and cataloged.
2. Network Segmentation: Surveillance cameras and other IoT devices should never be placed on flat, trusted corporate networks. Implementing strict network segmentation and VLANs isolates these devices, ensuring that even if a camera is successfully compromised via a command injection flaw, lateral movement across the broader enterprise network is restricted.
3. Firewalls and Perimeter Controls: Direct exposure of surveillance management interfaces to the public internet must be strictly prohibited. Organizations should mandate the use of secure, encrypted Virtual Private Networks (VPNs) for remote administrative access, effectively shielding camera management portals from automated threat scanners.
4. Credential Management: Routine security audits must be conducted to ensure that all default factory usernames and passwords are immediately replaced with strong, unique credentials upon deployment. Implementing multi-factor authentication (MFA) wherever supported adds an additional layer of defense against unauthorized access.
5. Rigorous Patch Management Policies: Establishing clear accountability between IT, security, and physical facilities management ensures that firmware updates are tested and applied systematically. Organizations should prioritize vulnerability management programs that treat IoT hardware with the same urgency applied to servers and desktop workstations.

As long as millions of connected devices remain deployed with insufficient oversight, weak default configurations, and delayed firmware adoption, incidents involving critical flaws like CVE-2021-36260 will continue to pose severe risks to global digital and physical security. Addressing this challenge requires a coordinated shift in manufacturing standards, regulatory oversight, and corporate asset management practices to ensure that the infrastructure designed to protect organizations does not ultimately become their most vulnerable entry point.