Loading story…
A Mysterium VPN investigation found more than 3 million internet-reachable cameras and recorders online, including 21,786 devices that were streaming live video with no authentication required. Researchers said the exposure was driven primarily by low-cost and legacy products rather than active exploitation, with RTSP representing the largest share of openly accessible video and accounting for 9,746 unauthenticated feeds. The report also noted that the researchers did not attempt default or weak passwords, indicating the number of reachable devices could be even higher.
The most heavily exposed systems were tied to budget and older platforms, including webcamXP and HiSilicon-class recorders, while major vendors such as Hikvision and Dahua were rarely exposed because of mandatory password setup policies. Japan and the United States accounted for more than a third of the open feeds, largely on residential broadband networks, raising privacy and physical security concerns as strangers could watch activity inside homes and other sensitive spaces. Recommended mitigations included setting strong passwords, disabling UPnP, limiting unnecessary RTSP exposure, updating firmware, and removing unmaintained devices from direct internet access.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
In May 2026, Mysterium VPN reported that more than three million internet-reachable cameras and recorders were exposed online, including 21,786 devices streaming live video with no authentication. The researchers said the exposure was concentrated in low-cost and legacy products, with many feeds accessible over RTSP and large concentrations in Japan and the United States.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
Researchers reconstructed **Operation CameraSwarm**, a 35-day campaign that compromised more than **14,530 Dahua IP cameras**, with the largest concentration of affected devices in **Ukraine and Russia**. The operation was pieced together from an exposed directory on `154.86.119.60` containing the operator’s tooling, logs, source code, and staging files. According to the report, the attackers used three parallel access paths: credential brute forcing on `TCP/37777`, exploitation of **`CVE-2021-33044`** and **`CVE-2021-33045`**, and abuse of Dahua’s **P2P cloud relay** to reach cameras by serial number. Researchers said the relay path relied on cloud-issued session tokens obtainable through fixed SDK credentials embedded in Dahua clients, enabling unauthenticated access through that channel. The operators also installed a persistent backdoor account, **`p2pwn` / `p2password`**, on **1,923 cameras**; the account reportedly survives password changes and, on most firmware, even factory resets, while offline-generated recovery codes could provide additional cloud-level administrative reset capability by serial number. Hunt.io said some CVE labels used in the tooling were incorrect, including a misreference to **`CVE-2024-39943`** and an overbroad use of **`CVE-2025-31702`**, and it made no attribution claim for the campaign. The same host also staged a separate UPX-packed Windows payload believed to be **SalatStealer** and a PowerShell script for Microsoft Defender exclusions. Defenders were urged to treat exposed Dahua cameras as potentially compromised, remove the `p2pwn` account, rotate credentials, disable P2P where unnecessary, and apply firmware updates covered by **Dahua `SA-2021-0130`**.
Sep 4, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026