Over 80,000 Hikvision Surveillance Cameras Remain Vulnerable to Critical Unpatched Command Injection Flaw Nearly a Year After Disclosure

Nearly a year after the disclosure of a critical security flaw, more than 80,000 internet-connected surveillance cameras manufactured by Hangzhou Hikvision Digital Technology continue to operate with a severe command injection vulnerability. Recent intelligence reports indicate that these exposed devices span thousands of organizations across more than 100 countries, leaving critical infrastructure, commercial enterprises, and residential networks open to potential compromise. Despite the National Institute of Standards and Technology (NIST) assigning the maximum severity score of 9.8 out of 10 to the vulnerability, the slow pace of remediation highlights systemic cybersecurity challenges inherent in the broader Internet of Things (IoT) ecosystem.

The core of the issue involves CVE-2021-36260, a critical command injection vulnerability affecting the web server component of numerous Hikvision IP camera models. Discovered and reported publicly in the autumn of 2021, the flaw allows unauthenticated remote attackers to send specially crafted messages containing malicious commands to vulnerable devices. Successful exploitation grants attackers the ability to execute arbitrary commands on the underlying operating system of the camera, effectively providing full administrative control over the hardware without requiring valid user credentials.

Chronology of a Critical Flaw

The timeline surrounding CVE-2021-36260 underscores the persistent gap between vulnerability disclosure and operational patching in enterprise and consumer hardware.

In September 2021, independent security researchers publicly disclosed the command injection vulnerability affecting a vast array of Hikvision camera models. Shortly thereafter, Hikvision released firmware updates designed to mitigate the flaw, urging system administrators and end-users to apply the patches immediately. The NIST formally cataloged the issue as CVE-2021-36260, rating it 9.8 out of 10 due to its network-exploitable nature, low complexity, and complete lack of required privileges for successful exploitation.

Throughout late 2021 and early 2022, security monitoring platforms and internet-scanning engines repeatedly identified hundreds of thousands of active devices running outdated, vulnerable firmware. By the summer of 2022, nearly eleven months after the initial patch release, threat intelligence analysts from Cyfirma published updated research revealing that over 80,000 devices remained completely unpatched globally. During this same period, intelligence feeds began detecting active reconnaissance and collaboration on Russian-language dark web forums, where threat actors openly discussed exploiting the vulnerability and traded compromised device credentials.

Global Reach and Regulatory Scrutiny

Hikvision, officially known as Hangzhou Hikvision Digital Technology Co., Ltd., is a state-owned video surveillance manufacturer headquartered in Zhejiang, China. The company supplies hardware to commercial, industrial, and government entities worldwide, holding a substantial share of the global video surveillance market.

The widespread deployment of Hikvision equipment has long been a subject of geopolitical and security debate. In 2019, the United States Federal Communications Commission (FCC) designated Hikvision as an unacceptable risk to U.S. national security under the Secure and Trusted Communications Networks Act. Despite such regulatory measures, municipal governments, educational institutions, retail chains, and private enterprises continue to utilize legacy hardware or fail to replace installed devices, frequently due to the high costs and logistical complexities associated with large-scale hardware lifecycles.

The exact volume of successful intrusions stemming from CVE-2021-36260 remains difficult to quantify. However, threat intelligence analysts have warned that state-sponsored advanced persistent threat (APT) groups—including entities often tracked as APT41, APT10, and various Russian cybercriminal organizations—have demonstrated both the capability and the strategic motivation to leverage compromised IoT devices. Such hardware often serves as an ideal initial entry point, allowing malicious actors to establish persistent footholds within corporate networks, conduct lateral movement, or launch secondary attacks while masking their true origins behind residential or commercial IP addresses.

Systemic Vulnerabilities within the IoT Landscape

Security experts emphasize that blaming end-users for failing to patch hardware oversimplifies a complex architectural and operational problem. David Maynor, senior director of threat intelligence at Cybrary, noted that Hikvision cameras have exhibited systemic security vulnerabilities and poor credential management practices over extended periods. According to Maynor, many affected devices rely on weak or hardcoded default passwords out of the box. Furthermore, he pointed out that enterprise-grade forensic capabilities are often absent in these systems, making it exceedingly difficult for security teams to verify whether an attacker has successfully compromised a camera or to completely eradicate malicious artifacts after an intrusion. Observers have also questioned whether the manufacturer has fundamentally altered its software development lifecycle to prioritize proactive security assurance.

Beyond individual manufacturer practices, privacy advocates and researchers point to structural deficiencies inherent in the broader IoT device ecosystem. Paul Bischoff, a privacy advocate with Comparitech, highlighted the stark contrast between modern computing endpoints and connected physical devices. While smartphones, tablets, and personal computers typically feature automated update mechanisms, background downloading, and prominent user notifications, IoT cameras rarely offer such seamless maintenance cycles.

"IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff explained. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date. Whereas your phone will alert you when an update is available and likely install it automatically the next time you reboot, IoT devices do not offer such conveniences."

The Discovery and Weaponization Gap

Compounding the problem of manual updates is the high visibility of internet-connected hardware. Automated threat actors and cybercriminals routinely leverage public search engines optimized for IoT discovery, such as Shodan and Censys, to scan the global IP space within minutes. These tools allow malicious entities to identify vulnerable firmware versions, open ports, and exposed administrative interfaces at scale.

When combined with default or weak credentials that are frequently left unchanged during initial deployment, the attack surface expands exponentially. Many organizations remain entirely unaware that their surveillance infrastructure is accessible from the public internet, lacking the continuous asset discovery tools necessary to maintain a complete inventory of connected operational technology.

Implications for Enterprise Security and Future Resilience

The prolonged exposure of tens of thousands of Hikvision cameras serves as a case study in the vulnerabilities of modern connected infrastructure. As organizations increasingly digitize their physical security systems, the convergence of operational technology (OT) and information technology (IT) creates new vectors for enterprise risk.

Security analysts argue that mitigating similar crises in the future will require coordinated action across multiple fronts. Manufacturers must adopt secure-by-design principles, eliminating default passwords, implementing robust cryptographic controls, and providing automated firmware update pathways where feasible. Simultaneously, organizations must implement rigorous asset management frameworks, continuous vulnerability scanning, and network segmentation to isolate physical security devices from critical corporate data networks.

Until systematic improvements are adopted across the supply chain, millions of IoT endpoints will likely remain exposed to legacy vulnerabilities, presenting a persistent challenge for defenders and an ongoing opportunity for sophisticated threat actors.