Network-connected surveillance cameras are often installed to protect offices, warehouses, retail premises and other facilities. Yet these devices can create a security blind spot when their firmware is not maintained as carefully as the computers and servers connected to the same network.

A prominent example is CVE-2021-36260, a critical command-injection vulnerability affecting certain Hikvision products. In an August 25, 2022 report, cybersecurity publication Threatpost cited research from Cyfirma that identified more than 80,000 potentially vulnerable Hikvision cameras worldwide. The finding highlighted how a known flaw can remain a significant operational risk long after a vendor has disclosed a fix.

Important context: the figure of more than 80,000 devices belongs to the 2022 research reported by Threatpost. It is not a verified count of vulnerable cameras in 2026. The current number of exposed devices cannot be established from that historical report alone.

What is CVE-2021-36260?

CVE-2021-36260 is an input-validation flaw in the web server of certain Hikvision products. The National Vulnerability Database (NVD), maintained by the U.S. National Institute of Standards and Technology, describes the issue as a command-injection vulnerability that could allow an attacker to submit specially crafted messages containing malicious commands.

The vulnerability received a CVSS v3.1 base score of 9.8 out of 10, placing it in the critical severity category. The score reflects the potential seriousness of the flaw; it does not mean that every camera is vulnerable or that every affected device has been compromised.

Command injection occurs when an application handles input in a way that allows unintended system commands to be executed. In a vulnerable network device, successful exploitation can threaten the confidentiality, integrity and availability of the system. The exact impact depends on the affected product, firmware, configuration and the attacker's access.

Organisations should therefore verify whether their particular camera models and firmware versions are affected rather than assuming that every Hikvision device has the same exposure.

Why the 80,000-camera finding matters

The 2022 Threatpost report described more than 80,000 cameras as remaining vulnerable almost a year after the flaw became public. It also reported that researchers had observed discussions about exploiting Hikvision cameras in Russian-language underground forums and offers involving leaked credentials.

Those observations are evidence of security concern, not a confirmed accounting of successful attacks against every device in the reported population. Threatpost said the extent of the damage was unclear. It would therefore be inaccurate to claim that all the identified cameras had been hacked or that a specific number of organisations had suffered breaches because of this flaw.

Nevertheless, the findings illustrate a persistent challenge in enterprise security: a patch can be available while vulnerable equipment remains in service. The reasons may include incomplete asset inventories, limited maintenance windows, unclear ownership, unsupported firmware, or concern that updates could interrupt physical security operations.

These challenges are especially important for cameras because they are often managed by facilities or physical-security teams rather than by the central IT department. If responsibilities are divided, an update may be missed even when the organisation has a formal vulnerability-management programme.

How a compromised camera could affect an organisation

The potential consequences extend beyond the loss of a video feed. Depending on the device and the conditions of exploitation, a compromised camera may expose sensitive footage, allow an attacker to alter device settings, or disrupt monitoring.

1. Loss of confidentiality

Surveillance footage can reveal employee activity, customer movements, delivery schedules and the layout of restricted areas. Unauthorised access to a camera may therefore create a privacy incident or expose information that helps an attacker plan a later intrusion.

2. Loss of system integrity

If an attacker gains sufficient control, camera settings or device functions could be manipulated. This may undermine the reliability of the surveillance system and make it harder for security personnel to trust what they see.

3. Disruption of physical security

Camera outages or altered views can reduce visibility during an incident. A compromised camera does not automatically grant access to a building, but it may weaken the monitoring and response processes designed to protect that building.

4. Potential exposure of connected systems

The wider network risk depends on architecture. A camera on a tightly restricted network has fewer opportunities to communicate with unrelated systems than a device that can reach business servers, user workstations or administrative interfaces. A compromised camera should not automatically be described as a gateway into the entire corporate network; that outcome depends on the permissions and connectivity available to it.

Why connected cameras are easy to overlook

Security teams commonly have established procedures for patching laptops, operating systems and internet-facing servers. Connected cameras can fall outside these routines because they are purchased, installed and maintained by different departments or contractors.

Other complications include devices with long service lives, inconsistent firmware-management tools, limited maintenance windows and incomplete records of model numbers or software versions. Some equipment may be reachable only through a vendor-specific management interface, making central monitoring more difficult.

The practical lesson is that patch management must include the devices used for physical security. An organisation cannot reliably assess its exposure if it does not know which cameras it owns, which firmware they run, who maintains them and whether they can communicate with the public internet.

What organisations should do now

Organisations using Hikvision equipment should treat CVE-2021-36260 as a specific verification and remediation task. The following steps provide a practical starting point.

1. Inventory camera assets. Record the manufacturer, exact model, firmware version, network address, location and responsible owner for every camera and associated recorder. Include devices managed by external security contractors.
2. Check the vendor advisory. Compare each model and firmware version with Hikvision's official security notification. Do not assume that a general firmware update applies to every product or regional variant.
3. Apply the appropriate security update. Follow the vendor's instructions for the exact device. Test the update where feasible, back up necessary configuration and confirm that the camera continues to operate correctly afterwards.
4. Reduce unnecessary network exposure. Do not expose camera administration interfaces directly to the public internet. Restrict management access to authorised administrators and trusted management networks, using secure remote-access methods where required.
5. Segment camera networks. Place cameras and recorders on dedicated network segments with firewall rules that permit only required communications. Limit access to business-critical servers and user devices.
6. Review credentials and access. Replace default or weak passwords, remove unused accounts, apply least-privilege access and use multi-factor authentication where the management platform supports it.
7. Investigate suspicious activity. Review available logs, management access records and network telemetry for unexpected connections or configuration changes. If compromise is suspected, isolate the affected device where operationally safe and follow the organisation's incident-response procedures.
8. Plan for unsupported equipment. If no security fix is available, seek vendor guidance and assess replacement. Until then, apply compensating controls such as strict network isolation and restricted management access.

These steps are complementary. Updating firmware addresses the known flaw, while network restrictions and access controls reduce exposure to other weaknesses and help contain the impact if a device is compromised.

Why HTTPS alone is not enough

Using encrypted management connections is an important security measure, but HTTPS does not repair a vulnerable application. If a device's web server mishandles input, encryption alone does not eliminate that flaw. Similarly, changing a password does not substitute for applying the correct firmware update.

Organisations should combine vendor-recommended patches with network segmentation, strong authentication, limited administrative access and monitoring. Security controls should be evaluated as a system rather than as isolated checklist items.

How to prioritise remediation

Not every device will have the same level of exposure. Security teams should prioritise cameras that are confirmed to run affected firmware, are reachable from untrusted networks, or protect sensitive areas. Devices with no available fix also require a documented risk decision.

A useful remediation record should include the affected asset, evidence of the firmware version, the vendor's recommended fix, the date of remediation, and a validation result. Where immediate patching is not possible, the record should identify the temporary safeguards, the person responsible and a deadline for reassessment.

This approach turns a one-time response into a repeatable process. It also gives managers a clearer view of residual risk instead of relying on an unverified count of vulnerable devices reported years earlier.

What the historical report can—and cannot—tell us

The 2022 report remains useful as a case study in delayed remediation. It documents a large reported population of vulnerable devices and describes concerns about exploitation interest and weak device-management practices.

It does not establish how many of those cameras remain vulnerable today, how many have been compromised, or whether the same scale of exposure persists in 2026. Those questions require current asset scans, verified vendor and firmware data, and fresh research with a clearly stated measurement date.

That distinction is central to responsible security reporting. Historical figures can explain why a vulnerability deserves attention, but they should not be presented as live telemetry without new evidence.

Frequently asked questions

What is CVE-2021-36260?

It is a critical command-injection vulnerability affecting the web server in certain Hikvision products. The NVD lists a CVSS v3.1 base score of 9.8. Organisations should check the official vendor advisory to determine whether their specific models and firmware versions are affected.

Are 80,000 Hikvision cameras still vulnerable in 2026?

The figure of more than 80,000 comes from research reported by Threatpost on August 25, 2022. That historical figure does not establish how many devices remain vulnerable today.

Does this vulnerability mean every affected camera has been hacked?

No. A vulnerable device is at risk, but vulnerability does not prove successful exploitation. The 2022 report said the overall extent of damage was unclear.

What is the first step for an organisation using Hikvision cameras?

Identify the exact camera models and firmware versions, then compare them with the manufacturer's security advisory. Apply the appropriate fix and restrict unnecessary network access while remediation is completed.

Can network isolation replace a firmware patch?

Network isolation can reduce exposure and limit possible impact, but it does not remove the underlying vulnerability. Apply the vendor-recommended update whenever one is available and suitable for the device.

Sources and references

1. Nelson, N. (2022, August 25). Cybercriminals Are Selling Access to Chinese Surveillance Cameras. Threatpost. Read the original report.
2. National Institute of Standards and Technology. NVD: CVE-2021-36260 Detail. National Vulnerability Database. Review the CVE record.
3. Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog: CVE-2021-36260. Review the CISA catalog.
4. Hikvision. Security Notification: Command Injection Vulnerability in Some Hikvision Products. Read the manufacturer's advisory.
5. Cybersecurity and Infrastructure Security Agency. Secure by Design. Review CISA's security guidance.

Editorial methodology: This article distinguishes the historical device count reported in 2022 from the current status of affected equipment. Technical claims are linked to the NVD and vendor advisory; claims about the reported device count and observed exploitation interest are attributed to Threatpost's coverage of Cyfirma research.

Source: Threatpost