Tens of Thousands of Hikvision Cameras Remain Vulnerable to Critical Unpatched Command Injection Flaw Nearly a Year After Disclosure

Nearly a year after the disclosure of a critical security vulnerability affecting widely used surveillance hardware, more than 80,000 Internet-connected devices continue to operate without necessary patches. New threat intelligence research highlights that tens of thousands of Hikvision surveillance cameras worldwide remain exposed to a severe command injection flaw designated as CVE-2021-36260. This oversight leaves organizations across multiple sectors, critical infrastructure facilities, and municipal networks vulnerable to remote compromise, espionage, and malicious disruption.

The ongoing exposure of these devices underscores a broader, systemic vulnerability within the Internet of Things (IoT) ecosystem. As threat actors, including advanced persistent threat (APT) groups and financially motivated cybercriminals, actively scan for and weaponize these known vulnerabilities, cybersecurity experts warn that the window for mitigating large-scale cyberattacks is rapidly closing.

Main Facts and Overview of the Vulnerability

The security flaw in question, CVE-2021-36260, carries a maximum severity rating of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), categorized by the National Institute of Standards and Technology (NIST) as critical. The vulnerability resides in the web server component of numerous Hikvision IP camera models. Specifically, it stems from improper input validation in HTTP requests, allowing an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system of the device.

Successful exploitation of this flaw grants an attacker full root-level access to the affected camera. With this level of access, malicious actors can intercept video feeds, disable recording capabilities, pivot deeper into the host organization’s internal network, or repurpose the compromised cameras to form botnets for distributed denial-of-service (DDoS) attacks.

Hikvision, formally known as Hangzhou Hikvision Digital Technology Co., Ltd., is a major global manufacturer of video surveillance products. Headquartered in China and partially state-owned, the company supplies hardware to customers in over 100 countries. Its products are deployed extensively across commercial enterprises, educational institutions, transportation hubs, and government facilities worldwide.

Despite the vendor releasing firmware updates to remediate the vulnerability in September 2021, telemetry data indicates that tens of thousands of units remain unpatched globally. Researchers analyzing global scanning data via specialized search engines such as Shodan and Censys have identified massive clusters of vulnerable firmware versions still operating in production environments.

Chronology and Timeline of Events

To understand the current state of exposure, it is necessary to examine the timeline of vulnerability disclosure, vendor response, and subsequent threat actor activity:

• September 2021: Independent security researcher Watchful IP publicly discloses CVE-2021-36260, detailing a critical command injection vulnerability in Hikvision IP cameras. Shortly thereafter, Hikvision releases official firmware updates designed to patch the flaw.
• Late 2021: Automated exploit scripts begin circulating within public code repositories and hacker forums. Security agencies issue advisories urging administrators to update affected hardware immediately.
• Early 2022: Threat intelligence firms observe initial scanning campaigns by opportunistic cybercriminals searching for unpatched Hikvision endpoints to build botnets and harvest credentials.
• Mid 2022: Intelligence reports emerge detailing targeted exploitation discussions on Russian-language dark web forums. Hackers begin trading credentials and discussing monetization strategies involving compromised surveillance networks.
• August 2022: Updated telemetry findings reveal that over 80,000 Hikvision cameras globally still run vulnerable firmware, highlighting persistent patch fatigue and the administrative challenges of managing distributed IoT hardware.

Geopolitical Scrutiny and Enterprise Risk

The persistence of CVE-2021-36260 intersects with existing geopolitical and regulatory concerns regarding Chinese-manufactured surveillance technology. In 2019, the United States Federal Communications Commission (FCC) designated Hikvision as an unacceptable risk to U.S. national security, citing potential threats to critical infrastructure and data privacy. Subsequent legislative and regulatory actions have sought to restrict the procurement of Hikvision equipment within federal agencies and sensitive government supply chains.

Security analysts emphasize that the combination of foreign manufacture, widespread global deployment, and critical software vulnerabilities creates a complex risk profile. While direct attribution remains difficult in the absence of explicit forensic artifacts, cybersecurity researchers speculate that sophisticated state-sponsored threat actors may target these devices. Groups associated with foreign intelligence operations—such as those tracked by intelligence agencies as APT41, APT10, or various Russian-based syndicates—frequently exploit vulnerable edge devices to establish persistent beachheads in foreign networks.

According to threat intelligence assessments, compromised surveillance systems offer unique strategic value. Beyond providing visual intelligence on physical locations, an infiltrated camera sitting inside a corporate or government perimeter can serve as an ideal pivot point for lateral movement into sensitive internal databases, administrative workstations, and operational technology (OT) networks.

Structural Challenges in Securing IoT Devices

The failure of thousands of organizations to apply an 11-month-old patch cannot be attributed solely to administrative negligence. Industry experts point out that securing IoT hardware presents distinct structural challenges that differentiate it from traditional enterprise software or personal computing devices.

David Maynor, senior director of threat intelligence at Cybrary, notes that surveillance cameras and similar edge devices often suffer from foundational design limitations. Many IoT products are engineered with systemic vulnerabilities or rely on predictable, hardcoded default credentials out of the box. Furthermore, Maynor highlights that performing effective digital forensics or verifying whether an attacker has successfully compromised a camera and installed persistent malware is exceptionally difficult for standard IT staff.

Compounding these technical hurdles is the absence of centralized patch management for most consumer and enterprise IoT deployments. Paul Bischoff, a privacy advocate with Comparitech, contrasts the update mechanisms of modern operating systems with those of embedded hardware.

"IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff explains. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date. Whereas your phone will alert you when an update is available and likely install it automatically the next time you reboot, IoT devices do not offer such conveniences."

This friction in the update process leaves a vast attack surface exposed. When device administrators fail to register products for manufacturer alerts, lack visibility into their network asset inventory, or neglect to alter default administrative passwords, devices become easy targets for automated discovery tools. Cybercriminals utilizing search engines configured to index connected hardware can pinpoint vulnerable IP addresses within minutes.

Industry Response and Mitigation Strategies

In response to the ongoing risks associated with CVE-2021-36260 and similar vulnerabilities, cybersecurity authorities, including the Cybersecurity and Infrastructure Security Agency (CISA) and international counterparts, have repeatedly issued guidance for asset owners.

Organizations utilizing Hikvision equipment are strongly advised to take immediate remediation steps:

1. Apply Firmware Updates: Administrators must verify device model numbers and apply the latest firmware patches provided by the manufacturer to close the command injection vector.
2. Isolate IoT Networks: Surveillance cameras and other smart devices should be placed on segmented, non-routable virtual local area networks (VLANs) isolated from core business networks and sensitive operational infrastructure.
3. Eliminate Default Credentials: All default usernames and strong, unique passwords must be enforced across all administrative interfaces.
4. Restrict External Access: Cameras should never be exposed directly to the public internet. Secure, authenticated virtual private network (VPN) connections or zero-trust network access (ZTNA) solutions should be utilized for remote monitoring and maintenance.
5. Implement Continuous Monitoring: Network administrators should deploy network monitoring tools to detect anomalous outbound traffic or unauthorized scanning attempts originating from IoT devices.

Broader Implications for the Future of Connected Infrastructure

The prolonged exposure of tens of thousands of Hikvision cameras serves as a cautionary tale for the rapid expansion of the Internet of Technology and IoT devices. As municipalities, enterprises, and smart-city initiatives deploy millions of connected sensors, cameras, and automation controllers, the attack surface expands exponentially.

Without a fundamental shift in how manufacturers approach secure software development lifecycles, and without the implementation of automated, friction-free update mechanisms for embedded systems, critical vulnerabilities will continue to languish unpatched. The widening gap between the discovery of high-severity flaws and their remediation in production environments represents one of the most pressing challenges in modern cybersecurity. Until organizations gain comprehensive visibility into their connected assets and prioritize edge-device hygiene, incidents involving neglected vulnerabilities will remain an open door for malicious actors worldwide.