Researchers identify 80K+ Hikvision cameras that have yet to be patched for flaws allowing remote code execution, despite fixes being available for months
Ionut Arghire / SecurityWeek :
Context & Ripple Effects
This is a patch-deployment story, not a disclosure story: Hikvision's fixes have existed for months, yet researchers still count 80,000+ internet-facing cameras running vulnerable firmware. It lands in a familiar arc — researchers disclosed a camera RCE 0-day affecting Nuuo software back in 2018, and consumer-camera maker Wyze was caught sitting on remote-access vulnerability warnings from Bitdefender for months and years earlier the same year.
The contrast case is network gear: when two IOS XE zero-days were weaponized, Cisco's patches plus visible exploitation drove hosts down from tens of thousands to hundreds within weeks — evidence that fix availability plus urgency can close gaps fast when owners act.
First-order effects
- Owners of the 80,000+ unpatched Hikvision cameras — businesses and installers who bought the hardware, not Hikvision itself — carry the immediate RCE exposure until someone pushes firmware to each device.
- Hikvision faces reputational drag despite having shipped fixes, because 'patch available' and 'patch deployed' are now publicly decoupled at scale.
Second-order effects
- Attackers get a pre-qualified target list: prior research found only 4,183 of 76,000 disclosed flaws were ever exploited in the wild (the 2009–2018 exploitation study), so widely publicized unpatched camera fleets concentrate attacker effort on the few bugs worth weaponizing.
- The Cisco IOS XE episode (zero-days hitting 50,000+ devices before cleanup) shows what happens when a fleet-scale flaw gets an automated exploit — camera integrators and managed-security providers will face pressure to offer patching as a service rather than leaving it to end customers.
Third-order effects
- If the pattern holds across Hikvision, Wyze, and the HiSilicon chip backdoor lineage, the structural problem is that IP-camera security ends at the vendor's download page — pushing regulators and insurers toward holding device owners and channel partners accountable for deployed-firmware state, not just purchase-time certifications.
- Camera fleets drift toward being treated as critical infrastructure attack surface, with procurement starting to weight update logistics and lifecycle support as heavily as image quality or price.
The trend: Physical-security devices are becoming a recurring mass-exposure category where vendors ship fixes but nobody deploys them, making patch-delivery mechanics — not vulnerability discovery — the industry's binding constraint.