Tens of Thousands of Hikvision Surveillance Cameras Remain Vulnerable to Critical Unpatched Flaw Nearly a Year Later

Nearly a year after the disclosure of a severe security vulnerability affecting state-of-the-art video surveillance hardware, more than 80,000 connected cameras manufactured by Hangzhou Hikvision Digital Technology continue to operate without necessary patches. This ongoing oversight leaves thousands of commercial enterprises, government facilities, and residential properties exposed to remote compromise. Cybersecurity researchers have recently published updated telemetry indicating that despite the widespread availability of a firmware update, a massive footprint of Internet of Things (IoT) hardware remains vulnerable to exploitation, drawing the attention of sophisticated nation-state actors and cybercriminal syndicates alike.

The vulnerability in question, cataloged as CVE-2021-36260, is a critical command injection flaw residing in the web server component of numerous Hikvision IP camera models. Given a maximum severity rating of 9.8 out of 10 by the National Institute of Standards and Technology (NIST), the flaw allows unauthenticated remote attackers to execute arbitrary commands on the underlying operating system simply by sending specially crafted messages to the affected device. Because video surveillance cameras are typically deployed at the perimeter of physical security perimeters—often connected directly to the public internet to facilitate remote viewing—this vulnerability effectively hands potential intruders an open digital back door into secured facilities.

Chronology of a Critical Flaw

The timeline surrounding CVE-2021-36260 highlights the prolonged nature of modern supply chain and IoT vulnerabilities. The critical command injection flaw was first discovered and reported to Hikvision in the summer of 2021. Recognizing the immense risk posed by the bug—which required zero user interaction and could be exploited over the network by anyone able to reach the camera’s web interface—Hikvision released an official firmware patch in September 2021.

However, the transition from patch release to patch deployment has proven exceptionally sluggish. In the months immediately following the disclosure, automated scanning tools deployed by security researchers identified hundreds of thousands of vulnerable endpoints globally. As the months pressed on, that number steadily declined through natural attrition, device replacement, and manual administrative updates. Yet, nearly a year after the initial patch became available, fresh intelligence reports indicate that upwards of 80,000 devices actively maintain the flawed firmware version, remaining fully exposed to automated exploitation scripts.

In the intervening months, threat intelligence firms have observed a disturbing evolution in how malicious actors interact with these exposed devices. Rather than remaining an obscure technical detail discussed only among vulnerability researchers, CVE-2021-36260 has become a sought-after commodity in underground cybercrime ecosystems. Investigators monitoring Russian-language dark web forums have detected multiple instances of threat actors collaborating on operationalizing the exploit, sharing scanning techniques, and even auctioning lists of compromised credentials tied to vulnerable Hikvision infrastructure.

Geopolitical Implications and Advanced Persistent Threats

The broad deployment of Hikvision equipment across more than 100 countries makes the persistence of CVE-2021-36260 a matter of international security concern. Hangzhou Hikvision Digital Technology is a state-owned enterprise headquartered in Hangzhou, China, supplying a vast share of the global market for video surveillance and physical security infrastructure.

The widespread adoption of these cameras has previously drawn scrutiny from regulatory bodies. In 2019, the United States Federal Communications Commission (FCC) designated Hikvision as an unacceptable risk to U.S. national security, citing concerns over foreign intelligence gathering and the potential for state-directed cyber espionage. These regulatory fears are amplified by the persistence of critical vulnerabilities like CVE-2021-36260.

Security analysts compiling recent threat assessments have expressed concern that advanced persistent threat (APT) groups could weaponize the unpatched cameras to establish persistent footholds within critical infrastructure networks. While definitive attribution remains challenging due to the stealthy nature of modern cyber espionage, threat intelligence reports suggest that Chinese state-sponsored collectives—such as groups tracked as MISSION2025 or APT41, alongside Russian threat actors—possess both the capability and the strategic motivation to leverage these vulnerabilities. Compromised cameras can serve multiple malicious purposes, including acting as pivot points for lateral movement within corporate networks, functioning as nodes in botnets for distributed denial-of-service (DDoS) attacks, or serving as persistent listening posts for long-term corporate and geopolitical intelligence gathering.

Systemic Vulnerabilities Across the IoT Ecosystem

The failure to remediate tens of thousands of Hikvision cameras points to broader systemic challenges plaguing the Internet of Things security landscape. Observers often attribute unpatched systems to administrative negligence or user apathy, but cybersecurity experts emphasize that the technical and architectural realities of IoT devices create unique hurdles that differentiate them from traditional enterprise IT assets.

David Maynor, senior director of threat intelligence at Cybrary, notes that the security posture of surveillance hardware often suffers from fundamental design deficiencies. According to Maynor, products within this category have historically contained systemic vulnerabilities alongside reliance on default administrative credentials. Furthermore, Maynor highlights a critical limitation in incident response capabilities: the operating systems running on many IP cameras do not provide adequate forensic logging or integrity verification tools. Consequently, system administrators have no reliable way to determine whether a device has already been compromised by an attacker, nor can they easily confirm that a malicious presence has been completely excised following remediation. Compounding these technical hurdles, critics argue that manufacturers like Hikvision have been slow to overhaul their internal software development lifecycles to prioritize proactive security engineering.

The structural friction of IoT updates is further compounded by user experience barriers. Paul Bischoff, a privacy advocate with Comparitech, points out the stark contrast between how consumer technology handles updates compared to commercial IoT hardware. While modern smartphones, operating systems, and browser applications prompt users for updates and frequently automate the patching process in the background, IoT devices typically lack these streamlined mechanisms.

"IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff explained. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date."

This lack of visibility leaves property managers and IT departments operating in the dark. Without centralized management dashboards or automated notification systems built into the legacy firmware, organizations often remain unaware that their physical security hardware represents a digital liability. This opacity is ruthlessly exploited by malicious actors who utilize internet-connected search engines such as Shodan and Censys to sweep the globe for vulnerable IP addresses within seconds.

The human element further exacerbates the technological deficit. Cybersecurity professionals frequently observe that installation technicians or end-users deploy cameras using factory-default usernames and passwords out of convenience. When combined with an unpatched remote code execution vulnerability, default credentials eliminate any technical barrier to entry for unauthorized intruders, transforming a physical safety measure into a digital vulnerability.

Broader Industry Impact and Path Forward

The enduring exposure of tens of thousands of Hikvision cameras serves as a cautionary tale for an increasingly interconnected world. As physical security systems, building management utilities, and industrial controls converge onto IP networks, the attack surface available to malicious actors expands exponentially.

Addressing this challenge requires a coordinated shift across multiple stakeholders in the security ecosystem. For device manufacturers, the imperative lies in modernizing development practices, adopting secure-by-design principles, implementing automated over-the-air (OTA) firmware update mechanisms, and deprecating legacy protocols that inhibit rapid patching. For end-users, enterprises, and public sector organizations, the situation underscores the urgent need for comprehensive asset discovery, rigorous network segmentation, and proactive vulnerability management programs that encompass physical security infrastructure alongside traditional workstations and servers.

Until these structural deficiencies are systematically addressed, critical vulnerabilities in mass-market IoT hardware will continue to present a persistent vector for compromise, bridging the physical and digital worlds with alarming vulnerability.