Over 80,000 Hikvision Surveillance Cameras Remain Vulnerable to Critical Command Injection Flaw Nearly a Year After Patch Release

Nearly a year after cybersecurity researchers and manufacturers disclosed a severe vulnerability affecting tens of thousands of video surveillance units worldwide, more than 80,000 Hikvision cameras remain unpatched and exposed to potential exploitation. The flaw, officially tracked as CVE-2021-36260, carries a maximum severity rating of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), designated by the National Institute of Standards and Technology (NIST) as critical. Despite repeated warnings from industry analysts, intelligence firms, and national security agencies, the persistent neglect of these endpoints highlights an ongoing, systemic crisis in the management and security posture of the Internet of Things (IoT).

The affected equipment is manufactured by Hangzhou Hikvision Digital Technology, a major Chinese state-owned enterprise specializing in video surveillance products and solutions. Hikvision devices are deployed extensively across more than 100 countries, serving both private enterprises and public sector entities. In the United States, however, the company’s market presence has faced significant regulatory headwinds. As early as 2019, the Federal Communications Commission (FCC) formally designated Hikvision equipment as an unacceptable risk to U.S. national security, restricting its deployment in federal infrastructure. Despite these domestic prohibitions, thousands of commercial enterprises, municipal networks, and private installations continue to utilize the manufacturer’s hardware.

The Core Vulnerability: CVE-2021-36260

The security deficit centers on a command injection vulnerability identified within the web server component of numerous Hikvision IP camera models. Specifically, the flaw exists due to improper input validation in the web management interface. An unauthenticated, remote attacker can exploit this weakness by sending specially crafted messages containing malicious command sequences to the affected device. Successful execution of the exploit allows the attacker to achieve arbitrary code execution with root-level privileges, effectively granting total control over the surveillance camera.

With root access, an unauthorized actor can manipulate the device’s firmware, intercept video feeds, pivot deeper into the host organization’s internal local area network (LAN), or deploy persistent malware. Because network cameras are routinely connected to sensitive corporate or municipal networks behind perimeter firewalls, compromising a single edge device can provide threat actors with a strategic foothold for lateral movement, espionage, or disruptive cyber attacks.

Chronology of an Unresolved Security Crisis

The lifecycle of CVE-2021-36260 underscores a troubling disconnect between software vendors, vulnerability disclosure timelines, and end-user remediation practices.

In September 2021, independent security researchers publicly disclosed the command injection vulnerability after identifying the flaw in multiple Hikvision firmware versions. Recognizing the severity of the issue, Hikvision released an emergency firmware update designed to patch the vulnerability later that same month. NIST subsequently assigned the CVE identifier and rated the bug at 9.8 out of 10, signaling that remote exploitation required no user interaction and could be automated at scale.

However, despite the immediate availability of the software patch, remediation rates stagnated. By late 2021 and early 2022, telemetry data from various cybersecurity firms indicated that hundreds of thousands of devices remained vulnerable.

By the summer of 2022—nearly eleven months after the patch was first introduced—new intelligence reports confirmed that over 80,000 instances of the vulnerable hardware were still exposed directly to the public-facing internet. During this period, threat intelligence analysts began observing malicious actors actively scanning for unpatched Hikvision endpoints. Investigations into Russian-language underground forums and dark web marketplaces revealed cybercriminals openly discussing, trading, and collaborating on exploit scripts targeting CVE-2021-36260, alongside bulk sales of compromised device credentials.

Geopolitical Implications and Threat Actor Interest

The persistence of tens of thousands of unpatched cameras has raised alarms among national security analysts and geopolitical intelligence units. Security researchers emphasize that internet-connected surveillance infrastructure represents a high-value target for both cybercriminal syndicates and advanced persistent threat (APT) groups.

While definitive attribution of active exploitation campaigns remains difficult due to the obfuscated nature of network intrusions, cybersecurity reports suggest that state-sponsored groups could leverage these vulnerabilities for strategic reconnaissance and intelligence gathering. Analysts have pointed out that threat actor groups operating within specific geopolitical spheres—such as those historically associated with state-backed operations in East Asia and Eastern Europe—possess the operational capabilities and tactical motivations to exploit compromised IoT networks. For organizations operating critical infrastructure, defense supply chains, or sensitive government adjacent industries, an unpatched camera on the perimeter constitutes an open back door for foreign intelligence collection.

Systemic Industry Failures in IoT Security

Attributing the widespread failure to patch solely to end-user negligence oversimplifies the structural challenges inherent in the modern IoT ecosystem. Security experts emphasize that securing consumer and enterprise hardware requires overcoming significant technical and operational barriers that do not exist in traditional desktop or mobile computing environments.

David Maynor, senior director of threat intelligence at Cybrary, notes that Hikvision devices have historically suffered from systemic design flaws and a reliance on weak or default administrative credentials. Furthermore, Maynor highlights the absence of robust forensic capabilities within these devices. When a Hikvision camera is compromised, security teams face immense difficulty performing post-incident forensics, verifying whether an attacker established persistence, or confirming that malicious access has been entirely eradicated. Critics also point to a perceived lack of proactive security improvements within the manufacturer’s underlying software development lifecycle (SDLC).

Complementing these observations, Paul Bischoff, a privacy advocate and security researcher at Comparitech, underscores the logistical hurdles of patch management in the IoT sector. Unlike modern operating systems, web browsers, or mobile applications that feature automated background updates and prominent user notifications, IoT devices operate largely out of sight and out of mind.

"IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff explained. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date. Whereas your phone will alert you when an update is available and likely install it automatically the next time you reboot, IoT devices do not offer such conveniences."

Compounding this lack of visibility is the widespread deployment of default factory settings. Many organizations install surveillance cameras out of the box without modifying default usernames and preset administrative passwords. When combined with automated network scanning tools—such as Shodan or Censys—cybercriminals can easily identify, catalog, and access vulnerable devices across the global internet within minutes.

Implications for Enterprise and Municipal Defense

The ongoing exposure of thousands of Hikvision cameras serves as a cautionary tale regarding the security posture of smart infrastructure. As organizations continue to integrate physical security systems with enterprise IT networks, the attack surface expands exponentially.

The implications of neglected IoT devices extend far beyond individual data privacy violations. A compromised camera network can be harnessed to launch distributed denial-of-service (DDoS) attacks, serve as a proxy for malicious traffic, or facilitate internal network mapping and credential harvesting. For municipal governments, educational institutions, and corporate enterprises, a single overlooked edge device can compromise an entire institutional network.

Addressing the crisis requires a fundamental shift in how organizations approach asset inventory, vulnerability management, and supply chain security. Industry best practices dictate that enterprise networks must maintain comprehensive asset management databases to track all connected hardware, ensure timely firmware updates, enforce strong password policies, and isolate IoT devices onto segmented virtual local area networks (VLANs) restricted from unnecessary outbound internet access.

Until organizations adopt rigorous lifecycle management for physical security devices, and manufacturers embed automated patching and robust security architectures into their baseline product designs, vulnerabilities like CVE-2021-36260 will continue to pose a pervasive threat to global cybersecurity.