Over 80,000 Hikvision Surveillance Cameras Remain Exposed to Critical Unpatched Vulnerability Nearly a Year Later

Nearly twelve months after the disclosure of a critical remote code execution vulnerability, more than 80,000 internet-connected surveillance cameras manufactured by Hangzhou Hikvision Digital Technology continue to operate without necessary security patches. Identified formally as CVE-2021-36260, the flaw carries a maximum severity score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), managed by the National Institute of Standards and Technology (NIST). Despite the severity rating and the widespread availability of a firmware fix, organizations spanning more than 100 countries remain exposed to potential takeover, data exfiltration, and lateral network compromise by malicious actors.

Recent intelligence reports highlight that sophisticated threat groups, including state-sponsored advanced persistent threat (APT) actors and cybercriminal syndicates operating on Russian-language dark web forums, are actively collaborating to weaponize the flaw. The ongoing persistence of these vulnerable devices underscores systemic challenges within the Internet of Things (IoT) hardware ecosystem, where manual update requirements, poor visibility, and legacy configuration standards frequently hinder rapid remediation.

The Origins and Anatomy of CVE-2021-36260

The security flaw at the center of the ongoing campaign was first discovered and reported to Hikvision in the summer of 2021. CVE-2021-36260 is classified as a command injection vulnerability stemming from improper input validation within the web server component of the affected camera firmware. Specifically, the web management interface fails to sufficiently sanitize input data passed through the HTTP server, allowing an unauthenticated remote attacker to construct malicious requests that execute arbitrary operating system commands with root-level privileges.

Because surveillance cameras typically sit at the perimeter of physical and digital security infrastructure—often connected directly to the public internet to facilitate remote monitoring via mobile applications—a successful exploit grants attackers complete control over the device. Once an adversary gains root access, they can manipulate video feeds, disable recording capabilities, use the compromised camera as a pivot point to move deeper into the host organization’s internal corporate network, or conscript the device into a botnet for distributed denial-of-service (DDoS) attacks.

Chronology of a Critical Flaw

The lifecycle of CVE-2021-36260 highlights the prolonged window of exposure that frequently characterizes critical IoT vulnerabilities:

• June to July 2021: Security researchers identify the command injection vulnerability in Hikvision’s web server module and responsibly disclose the flaw to the vendor.
• September 2021: Hikvision releases official firmware updates designed to patch CVE-2021-36260 across its extensive product lineup, urging users to apply the fixes immediately.
• October 2021: NIST assigns the vulnerability a critical CVSS score of 9.8. Public exploitation proofs-of-concept (PoCs) begin circulating within security research communities, demonstrating how easily unauthenticated commands can be executed.
• Late 2021 to Mid 2022: Automated scanning infrastructure deployed by both security researchers and malicious actors identifies hundreds of thousands of vulnerable IP addresses globally. Threat intelligence feeds note an increase in dark web discussions regarding the monetization of access derived from the flaw.
• August 2022: Follow-up telemetry and threat intelligence assessments reveal that over 80,000 units remain actively vulnerable and connected to the public internet, prompting renewed warnings from cybersecurity analysts.

Global Reach and Geopolitical Implications

Hangzhou Hikvision Digital Technology is the world’s largest manufacturer of video surveillance equipment, supplying hardware to municipal governments, critical infrastructure operators, educational institutions, and private enterprises across more than 100 countries. However, the company’s market dominance has increasingly intersected with international trade and national security disputes.

In 2019, the United States Federal Communications Commission (FCC) designated Hikvision as an entity presenting an "unacceptable risk to U.S. national security," citing close ties to the Chinese state and potential risks related to data sovereignty and foreign intelligence gathering. Despite such regulatory designations and prohibitions on direct federal procurement of Hikvision hardware, millions of units remain installed across commercial and residential properties throughout North America, Europe, and Asia.

The ongoing presence of unpatched vulnerabilities in state-linked or foreign-manufactured hardware has intensified geopolitical concerns. Threat intelligence analysts note that state-sponsored espionage groups—including actors tracked under designations such as APT41, MISSION2025, and APT10—frequently scan for and exploit known perimeter vulnerabilities to establish initial footholds. While definitive attribution for widespread exploitation of CVE-2021-36260 remains complex, security researchers emphasize that the convergence of critical vulnerabilities, weak default credentials, and potential geopolitical motivations creates a high-risk environment for critical infrastructure operators.

The Systemic Vulnerability of the IoT Ecosystem

The failure of tens of thousands of organizations to patch a critical vulnerability nearly a year after its disclosure cannot be attributed solely to administrative oversight or negligence. Industry experts point out that securing connected hardware presents structural challenges that fundamentally differ from traditional enterprise software or consumer operating systems.

David Maynor, senior director of threat intelligence at Cybrary, notes that Hikvision devices have historically suffered from systemic security design issues. According to Maynor, products in this category frequently utilize weak default credentials out of the box and lack robust logging mechanisms, making it exceedingly difficult for network administrators to perform digital forensics or determine whether an unauthorized party has previously compromised the device. Furthermore, critics argue that hardware manufacturers often lag in adopting modern secure development lifecycle (SDLC) practices that prioritize proactive vulnerability reduction.

Compounding these design challenges is the consumer and enterprise experience of device management. Unlike modern personal computers or mobile operating systems—which prompt users with clear notifications and support automated background updates—most commercial IoT devices require manual intervention. Paul Bischoff, a privacy advocate with Comparitech, highlights the friction inherent in the update process: "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date."

Because security cameras are often treated as "set-and-forget" appliances, organizational IT departments may lose track of physical assets over time, especially as personnel turn over or contractors deploy equipment without updating central asset inventories. Meanwhile, cybercriminals leverage automated search engines and scanning tools such as Shodan and Censys to sweep the IPv4 address space continuously, indexing vulnerable camera models within seconds and compiling databases of exposed targets available for exploitation or resale on underground markets.

Industry Response and Mitigation Strategies

In response to ongoing security concerns, cybersecurity agencies and private threat intelligence firms continue to urge immediate remediation for organizations utilizing Hikvision equipment. The primary mitigation for CVE-2021-36260 is the installation of the official firmware patch provided by Hikvision through its regional support portals.

However, for organizations unable to immediately patch due to operational constraints or legacy hardware limitations, security professionals recommend implementing strict network segmentation and perimeter defense measures. These defenses include:

1. Isolating Surveillance Networks: Placing all IP cameras and video management systems (VMS) on a dedicated, air-gapped internal VLAN that is strictly separated from corporate data networks and critical IT assets.
2. Eliminating Direct Public Access: Disabling port forwarding (such as exposing HTTP ports 80 or RTSP ports to the public internet). Instead, remote access should be funneled exclusively through secure, encrypted Virtual Private Networks (VPNs) or zero-trust network access (ZTNA) solutions.
3. Hardening Credentials: Changing all default administrative usernames and passwords immediately upon deployment, utilizing complex, unique passphrases, and disabling unnecessary network services such as Telnet or UPnP.
4. Implementing Edge Filtering: Utilizing firewalls and intrusion detection systems (IDS) to monitor inbound and outbound traffic patterns for anomalous command execution signatures characteristic of exploitation attempts against web servers.

Broader Impact and Future Outlook

The persistence of CVE-2021-36260 serves as a prominent case study in the vulnerability remediation gap that continues to plague enterprise IoT deployments. As physical security systems increasingly converge with IP networks, they expand the traditional corporate attack surface, offering adversaries low-effort entry points into well-defended environments.

Without significant shifts toward automated patching frameworks by manufacturers, stricter regulatory standards for imported IoT hardware, and heightened asset visibility among enterprise security teams, critical hardware vulnerabilities will likely remain a persistent vector for cyber espionage and automated extortion. Until organizations adopt a lifecycle management approach that treats cameras and sensors with the same rigorous patch management discipline applied to servers and workstations, tens of thousands of exposed devices will remain ticking time bombs on the global digital perimeter.