Researchers disclose 0-day flaw allowing remote code execution on security cameras running Nuuo software, say hundreds of thousands of devices may be affected
Charlie Osborne / ZDNet :
Context & Ripple Effects
This disclosure extends a pattern the coverage has tracked for years: security cameras shipping with remotely exploitable flaws and staying vulnerable long after fixes exist. Researchers found 80K+ Hikvision cameras still unpatched months after fixes shipped, and Wyze sat on remote-access vulnerabilities flagged by Bitdefender before acting.
The Nuuo report is different in kind: a 0-day with no fix available at disclosure, potentially spanning hundreds of thousands of devices running its software. It also echoes component-level risk — the HiSilicon chip backdoor active since 2013 showed how deeply embedded camera flaws can run.
First-order effects
- Operators running Nuuo-based camera systems face immediate exposure to remote code execution with no vendor patch to apply yet, making network isolation or shutdown the only mitigation.
Second-order effects
- Buyers and integrators weighing camera vendors will press on patch responsiveness, where the record is poor — Hikvision's unpatched fleet and Wyze's delayed fixes show disclosure alone does not get devices fixed.
Third-order effects
- If unpatched fleets remain the norm across vendors, surveillance deployments will drift toward regulation or procurement mandates requiring demonstrated patch SLAs rather than trusting vendor advisories.
The trend: Security camera vulnerabilities keep surfacing faster than deployed devices get patched, turning the installed base itself into the industry's standing liability.