How do security cameras get hacked?
Nearly every camera compromise starts with configuration, not code-breaking. A network camera is a small Linux computer with a lens attached. It runs a web server, accepts remote connections, and often sits on the same network as point-of-sale terminals, file servers, and employee laptops. When that computer ships with a documented default password and never receives a firmware update, an attacker does not need to be brilliant. They need a search engine.
Verkada's engineering team observes that legacy camera fleets commonly run unencrypted footage, unpatched firmware, and default passwords, an attributed industry observation that matches what independent assessors report from the field. Four failure patterns account for most real-world incidents:
- Default and shared credentials. Factory passwords are published in manuals and scraped into attacker tooling. Shared logins mean one leaked password exposes the whole fleet and leaves no audit trail showing who did what.
- Unpatched firmware. Camera vulnerabilities are disclosed regularly, but many devices never receive the fix because nobody owns the update process after installation day.
- Flat networks. When cameras share a network with business systems, one compromised device becomes a pivot point into everything else on the wire.
- Unencrypted transport. Video feeds and credentials sent in plaintext can be intercepted or replayed by anyone with access to the network path.
None of this requires a sophisticated adversary. It requires a target that skipped the basics, which is why the hardening steps later in this guide focus on fundamentals rather than exotic tooling.
What CVE-2021-36260 teaches about camera risk
CVE-2021-36260 is worth studying because it shows how bad a camera vulnerability can get. Disclosed in 2021, it is a command injection flaw in the web server of many Hikvision cameras. An unauthenticated attacker could send a crafted request and gain full control of the device without ever knowing a password.
The vulnerability's inclusion in CISA's Known Exploited Vulnerabilities catalog matters. CISA adds a CVE to that catalog only when there is evidence of active exploitation in the wild, and listed vulnerabilities carry mandatory remediation deadlines for US federal civilian agencies. In other words, this was not a theoretical lab finding. Attackers used it against real cameras on real networks.
Three lessons carry over to any video deployment:
- A camera is a foothold, not just a camera. A fully compromised device can be conscripted into a botnet, used to watch your own site, or used as a beachhead to attack the rest of the network.
- Patch latency is the real exposure. The gap between disclosure and installation is when exploitation happens, and unmanaged cameras often sit in that gap for years.
- Management interfaces do not belong on the open internet. Many exploited cameras were reachable directly from the public internet, which turned a patchable flaw into an open door.
Why the camera supply chain matters: the FCC Covered List
Hardening settings only goes so far if the device itself comes from a vendor the US government has flagged as a national security risk. That is the compliance backdrop behind the FCC Covered List, which includes video surveillance equipment from Hikvision and Dahua alongside telecom gear from Huawei, ZTE, and Hytera.
In November 2022, the FCC adopted an order barring new equipment authorizations for gear on the Covered List, implementing the Secure Equipment Act of 2021, as summarized by the Congressional Research Service. Because nearly all electronics sold in the US require an FCC equipment authorization, the order effectively blocks new covered camera models from entering the market through the front door. The FCC then tightened the equipment-authorization program further against covered vendors in a rule published December 4, 2025 in the Federal Register, a signal that the regulatory direction is one-way.
For buyers, the practical takeaway is to treat vendor origin as a security control, the same way you treat passwords and patching. If your organization touches federal contracts or federal funding, compliance is not optional. Even purely private deployments inherit the patching discipline and disclosure track record of whoever built the camera, so a manufacturer with a history of slow or opaque security responses is a risk regardless of regulation. Our NDAA compliance overview explains how VDS approaches this, and the NDAA-compliant camera buyer's guide walks through how to verify a vendor's status before you sign anything.
A practical security camera hardening checklist
The controls below are ordered by impact for a typical fixed or mobile camera deployment. Most can be implemented by an IT generalist within a week, and none require an enterprise security budget.
| Control | What it blocks | Practical step |
|---|---|---|
| Unique credentials per device | Credential stuffing; fleet-wide compromise from one leak | Rotate all factory passwords at install, store them in a password manager, enable MFA on the VMS |
| Firmware patch cadence | Known-CVE exploitation such as CVE-2021-36260 | Monthly patch window plus an emergency process for KEV-listed flaws |
| Network segmentation (VLANs) | Lateral movement from a hacked camera into business systems | Dedicated camera VLAN with firewall rules allowing only VMS and NTP traffic |
| Encrypted transport | Feed interception and credential capture | HTTPS/TLS for management; encrypted streams or VPN tunnels for video |
| Disable unused services | Hidden remote-access paths | Turn off telnet, UPnP, and peer-to-peer features you do not use |
| Supply-chain vetting | Vendors with poor security track records or Covered List status | Check FCC authorization status and vendor disclosure history before purchase |
Segment the network before anything else
If you only do one thing, put cameras on their own VLAN with a default-deny firewall policy. Each camera should be able to reach its video management system and a time server, and nothing else. This single change converts a future camera compromise from a network-wide incident into a contained nuisance. It also stops cameras from quietly phoning home to cloud services you never approved.
Make patching a calendar event, not an intention
Firmware updates fail as a security control when they depend on someone remembering. Put a recurring patch window on the calendar, subscribe to your vendors' security advisories, and check the CISA KEV catalog whenever a camera CVE makes the news. Patching also fits naturally into routine upkeep: our security camera maintenance checklist includes firmware review alongside lens cleaning and storage checks, so the work actually happens instead of living on a wish list.
Encrypt transport end to end
Insist on HTTPS for every management interface and encrypted streaming for video, whether that is native TLS support or a VPN tunnel between site and viewer. Unencrypted feeds are not just an interception risk. They normalize plaintext credentials on the network, which is how one curious contractor with a packet capture tool becomes an incident report.
Vet the vendor like a supplier, not a gadget
Before buying, ask three questions. Does the manufacturer publish security advisories and ship patches promptly? Is the equipment authorized for sale in the US and clear of the Covered List? Does it support encrypted transport and modern authentication out of the box? A camera line that fails any of these will cost more in risk than it saves in hardware.
Who should own the patching burden?
For most organizations, the honest answer is: not your own staff. The checklist above is straightforward, but it fails silently when the person who owned it changes roles, and camera fleets have a way of outliving the IT projects that deployed them.
Managed video platforms move that burden to the provider. Firmware and security patches are pushed centrally across the fleet, devices are monitored for health and tampering, and encrypted transport is the default rather than a configuration project. This matters more as video systems get smarter: in a 2026 global survey commissioned by Verkada and conducted by The Harris Poll of 2,741 IT and security leaders across 10 markets, 80% of organizations reported actively using or piloting AI in physical security. That figure is vendor-commissioned and should be read with that caveat, but the direction is clear. Video systems are becoming connected, analytics-heavy platforms, and their security has to be managed like software, not like hardware.
When you evaluate a managed option, ask who patches, how quickly KEV-listed vulnerabilities are remediated, and whether analytics run on hardened infrastructure. Our overview of how a managed video platform works covers the architecture, and this guide to AI video analytics for security cameras explains what those analytics layers do with the footage they protect.
Hackers are not the only threat to your cameras
Cybersecurity hardening addresses the digital attack surface, but cameras also face physical and radio-frequency attacks: cut cables, stolen recorders, and signal jamming aimed at wireless links. The defenses rhyme with the digital ones, including on-device storage that keeps recording through an outage and health monitoring that flags a silent camera within minutes rather than weeks. Our breakdown of how Wi-Fi jammers affect security cameras covers that side of the threat model in detail.
This layered view is how VDS builds its monitored deployments. Mobile surveillance units run NDAA-compliant cameras on a managed platform: firmware is patched centrally, video travels over encrypted cellular links rather than a customer's business network, and a 24/7 monitoring center notices when a unit goes quiet, whether the cause is a jammer, a power fault, or an intrusion attempt. The customer gets the hardening checklist as a built-in property of the system instead of a standing IT chore.
The bottom line: cameras get hacked through neglect far more often than through genius. Segment the network, fix the credentials, patch on a schedule, encrypt the transport, and buy from vendors who take security seriously, and your video system stays what it was meant to be, a security asset rather than an attack surface.