Unpatched Surveillance Networks Face Growing Global Exploitation Risk

Security researchers have uncovered a persistent digital shadow looming over global infrastructure, where tens of thousands of video surveillance units remain susceptible to long-known exploits. Despite the passage of nearly a year, a significant population of connected hardware continues to operate with critical security gaps, creating a playground for threat actors seeking unauthorized entry into private and public networks.

Critical Flaws Remain Unaddressed

The core of the issue involves a command injection vulnerability identified as CVE-2021-36260. Originally disclosed as a severe threat, this flaw carries a 9.8 out of 10 criticality rating from NIST, yet it continues to plague 80,000 Hikvision surveillance cameras worldwide. The longevity of this vulnerability—now 11 months old—underscores a dangerous disconnect between vendor disclosure and actual field remediation.

The threat landscape has evolved beyond mere exposure, with evidence suggesting that criminal elements are actively organizing to monetize this access. Observations from dark web forums, particularly those based in Russia, reveal hackers openly collaborating to exploit these specific devices, often trading leaked credentials to facilitate unauthorized entry.

• Over 80,000 Hikvision cameras remain vulnerable to the flaw.
• The exploit is identified by the identifier CVE-2021-36260.
• NIST assigned the vulnerability a critical 9.8 out of 10 score.
• The manufacturer serves customers in over 100 countries.

Systemic Obstacles to Secure Hardware

The difficulty in securing these devices is not merely a matter of user negligence, but a reflection of deeper, industry-wide issues regarding Internet of Things (IoT) management. Unlike modern mobile ecosystems that prioritize seamless, automated updates, these surveillance units often require complex manual intervention from operators who may not even be aware of the underlying risks.

Their product contains easy to exploit systemic vulnerabilities or worse, uses default credentials. There is no good way to perform forensics or verify that an attacker has been excised. Furthermore, we have not observed any change in Hikvision’s posture to signal an increase in security within their development cycle.

According to David Maynor, senior director of threat intelligence at Cybrary, the combination of default credentials and the inability to conduct reliable post-compromise forensics creates a perpetual state of insecurity. This is exacerbated by the lack of defensive visibility, as these devices often fail to communicate their update status or compromised state to their owners.

Geopolitical Stakes and Future Risks

The potential for abuse extends far beyond petty cybercrime. Research suggests that sophisticated state-backed groups—including MISSION2025/APT41 and APT10—may leverage these weaknesses to pursue geo-political objectives. When hardware is deployed across more than 100 countries, the resulting security vacuum becomes a strategic liability.

For businesses and organizations relying on these surveillance systems, the implications are stark. The failure to address these vulnerabilities means that networks remain open to reconnaissance via tools like Shodan or Censys. Without a fundamental shift in how IoT manufacturers handle patch deployment and default security settings, these organizations face the ongoing risk of silent, persistent intrusion by actors capable of exploiting unpatched devices for long-term surveillance or network pivot points.