Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed.

The global cybersecurity landscape faces a persistent and critical challenge as over 80,000 Hikvision surveillance cameras remain vulnerable to a high-severity command injection flaw nearly a year after a patch was made available. This ongoing exposure underscores the systemic difficulties in managing Internet of Things (IoT) security across enterprise and government infrastructure, raising significant concerns about surveillance integrity, unauthorized network access, and the potential for large-scale state-sponsored espionage.

The vulnerability, designated as CVE-2021-36260, was first disclosed in the autumn of 2021. It carries a CVSS score of 9.8 out of 10, categorizing it as "critical." The flaw allows unauthenticated attackers to execute arbitrary commands on the affected devices by sending malicious messages to the camera’s web server. Despite the passage of time and repeated warnings from cybersecurity researchers and national security agencies, a significant portion of the global deployment of these devices remains unpatched, effectively providing a wide-open gateway for threat actors to infiltrate private and public networks.

The Anatomy of the Vulnerability and Its Origins

Hikvision, the world’s largest manufacturer of video surveillance equipment, has faced intensifying scrutiny regarding both the security of its hardware and its corporate ties to the Chinese state. Headquartered in Hangzhou, the company provides surveillance solutions to more than 100 countries. However, the ubiquity of its devices is increasingly viewed as a liability. In 2019, the United States Federal Communications Commission (FCC) officially labeled Hikvision an "unacceptable risk to U.S. national security," citing concerns that its products could facilitate surveillance and intelligence gathering by foreign actors.

The CVE-2021-36260 flaw is a classic command injection vulnerability. It stems from a failure to properly sanitize input in the camera’s web server interface. When exploited, it permits an attacker to achieve root-level access to the camera’s operating system. Once an attacker gains control of a camera, they can use it as a pivot point to move laterally through the internal network of a corporation or government agency, exfiltrate sensitive footage, or incorporate the devices into a massive botnet for Distributed Denial of Service (DDoS) attacks.

Chronology of the Crisis

The lifecycle of this vulnerability illustrates the friction between software disclosure and real-world implementation.

• September 2021: Hikvision acknowledges the existence of the command injection vulnerability and releases firmware updates to remediate the issue across its product lines.
• Late 2021: Security researchers begin identifying active scanning efforts directed at Hikvision devices. Public exploit code begins to circulate in restricted security forums, lowering the barrier to entry for novice hackers.
• Early 2022: Despite the availability of patches, global telemetry from search engines like Shodan and Censys reveals that tens of thousands of devices are still running outdated firmware.
• Mid-2022: Intelligence reports from firms like Cyfirma indicate an uptick in dark web activity. Specifically, Russian-language forums see an increase in discussions regarding the exploitation of Hikvision hardware, with leaked administrative credentials being traded or sold.
• Present Day: Cybersecurity analysts confirm that over 80,000 instances of the hardware remain exposed to the original exploit, highlighting a failure in patch management workflows across global organizations.

The Structural Weakness of IoT Ecosystems

The failure to remediate these devices is not merely a matter of user negligence; it is indicative of a broader, structural failure in the IoT industry. Unlike modern desktop operating systems or mobile applications, which employ sophisticated, automated update mechanisms, IoT devices frequently require manual intervention to maintain security.

David Maynor, senior director of threat intelligence at Cybrary, notes that the problem is rooted in the design philosophy of these manufacturers. "Their product contains easy-to-exploit systemic vulnerabilities or, worse, uses default credentials," Maynor explains. "There is no good way to perform forensics or verify that an attacker has been excised. Furthermore, we have not observed any change in Hikvision’s posture to signal an increase in security within their development cycle."

This sentiment is echoed by privacy advocates who argue that the burden of security should not rest solely on the end-user. Paul Bischoff, a privacy advocate with Comparitech, highlights the lack of transparency in IoT hardware. "IoT devices like cameras aren’t always as easy or straightforward to secure as an app on your phone," Bischoff states. "Updates are not automatic; users need to manually download and install them, and many users might never get the message. Furthermore, IoT devices might not give users any indication that they’re unsecured or out of date."

Geopolitical Implications and Threat Actors

The intelligence community has expressed heightened concern regarding which actors may be leveraging these unpatched devices. While opportunistic cybercriminals are undoubtedly utilizing the vulnerability for financial gain or botnet recruitment, the potential for state-sponsored espionage is a primary concern.

Analysts at Cyfirma have identified that the specific nature of the vulnerability makes it an attractive tool for sophisticated Advanced Persistent Threat (APT) groups. The report highlights potential interest from groups such as MISSION2025/APT41 and APT10. These actors often prioritize long-term persistence within sensitive networks. By compromising a device that is rarely monitored—such as an outdoor security camera—these groups can maintain a "low and slow" presence, avoiding the detection that often occurs when compromising high-profile servers or workstations.

The geopolitical considerations are stark. Given the origins of the manufacturer, there is a lingering fear that these devices could be utilized for domestic or international surveillance, effectively turning an organization’s security infrastructure against itself.

The Persistent Threat of Default Credentials

A significant contributor to the current exposure is the industry-wide reliance on default credentials. Many Hikvision units ship with a standard username and password configuration. While manufacturers encourage users to change these upon setup, user error and the sheer volume of devices deployed in large-scale enterprise environments mean that many remain active with "factory settings."

When combined with the command injection vulnerability, the security risk is compounded. An attacker does not even need to be highly skilled to gain entry; they can utilize automated scripts to scan for Hikvision devices, attempt default credentials, and, if those fail, deploy the CVE-2021-36260 exploit to bypass authentication entirely.

Moving Toward a More Secure Framework

The persistent exposure of these 80,000 devices serves as a wake-up call for the cybersecurity industry. Addressing this issue requires a two-pronged approach: technical innovation and policy reform.

Technically, the industry must transition toward "secure-by-design" principles. This includes enforcing unique passwords for every device, requiring automatic update mechanisms that cannot be disabled by end-users, and providing robust logging capabilities that allow security teams to detect anomalous behavior.

From a policy perspective, the reliance on IoT devices from manufacturers with poor security track records must be re-evaluated. Governments, particularly in the United States and the European Union, are increasingly discussing "cyber hygiene" mandates for critical infrastructure. Such mandates might require periodic third-party audits of connected devices and the prohibition of hardware that does not meet established security benchmarks.

As it stands, the tens of thousands of unpatched Hikvision cameras represent a latent risk to global network security. Until organizations prioritize the lifecycle management of their IoT hardware with the same rigor they apply to their IT servers, they will remain vulnerable to a class of attacks that is entirely preventable through proper maintenance and proactive security posture management. The window for patching has been open for eleven months; the continued failure to act is an invitation for exploitation that the modern threat landscape can ill afford.