More Than 21,000 Internet-Exposed Home Cameras Stream Live Video Without Authentication

A Mysterium VPN investigation found more than 3 million internet-reachable cameras and recorders online, including 21,786 devices that were streaming live video with no authentication required. Researchers said the exposure was driven primarily by low-cost and legacy products rather than active exploitation, with RTSP representing the largest share of openly accessible video and accounting for 9,746 unauthenticated feeds. The report also noted that the researchers did not attempt default or weak passwords, indicating the number of reachable devices could be even higher.

The most heavily exposed systems were tied to budget and older platforms, including webcamXP and HiSilicon-class recorders, while major vendors such as Hikvision and Dahua were rarely exposed because of mandatory password setup policies. Japan and the United States accounted for more than a third of the open feeds, largely on residential broadband networks, raising privacy and physical security concerns as strangers could watch activity inside homes and other sensitive spaces. Recommended mitigations included setting strong passwords, disabling UPnP, limiting unnecessary RTSP exposure, updating firmware, and removing unmaintained devices from direct internet access.