Is Your CCTV Hackable? A Cyber Security Checklist for Cameras and DVRs

Your CCTV is a computer on the internet

DVRs, NVRs and IP cameras run operating systems, connect to your network and often to the internet. If they are not secured, attackers can watch your cameras, switch them off, use them to attack others, or use them as a way into your office network. The Ministry of Electronics and IT warned government departments about information-leakage risks from CCTV, DVRs and NVRs in March 2024 — one of the reasons India introduced security certification for cameras.

Real examples

• In June 2025, security researchers at Kaspersky reported a Mirai-variant botnet exploiting a command-injection flaw (CVE-2024-3721) in certain TBK DVR models, sold under several brand names, with tens of thousands exposed online.
• In December 2025, the US cybersecurity agency CISA flagged active exploitation of a flaw in an end-of-life NVR that will never be patched.
• Major manufacturers, including Hikvision and Dahua, publish security advisories and firmware fixes for their recorders and cameras — updates only help if they are installed.

How systems are usually compromised

• Default or weak passwords never changed after installation.
• Old firmware with known vulnerabilities.
• Recorders exposed directly to the internet through router port forwarding.
• Cameras on the same network as office computers and guest Wi-Fi.
• Unsupported, end-of-life or uncertified devices.
• Shared logins that former staff or installers still know.

Signs your system may be compromised

If you see these, disconnect the recorder from the internet, change all passwords from a clean device, update firmware, and have the system checked.

• Unknown user accounts on the recorder or in the app.
• Passwords that suddenly no longer work.
• Camera settings changed — angles, recording schedules, or cameras disabled.
• Unusually high upload traffic from the recorder on your router.
• Your recorder’s IP appearing in alerts from your ISP.

A 12-point checklist

• 1. Change every default password on the recorder, cameras and router.
• 2. Use a unique, strong password for the recorder and the mobile app account.
• 3. Turn on two-step verification on the app account if available.
• 4. Update recorder and camera firmware from the manufacturer’s official source.
• 5. Remove router port forwarding to the recorder; use the brand’s cloud/P2P service instead.
• 6. Disable services you do not use (UPnP, Telnet, unused ports).
• 7. Put cameras and recorders on a separate network or VLAN.
• 8. Share access through the app’s user sharing, not by sharing your password.
• 9. Remove access for former staff and installers.
• 10. Replace end-of-life devices that no longer receive updates.
• 11. Buy certified IP camera models from authorised channels.
• 12. Review the system at least once a year — or include it in your AMC.

Network design helps most

The single most effective step for businesses is network separation: cameras and the NVR on their own network segment, with only the access they need. If a camera is ever compromised, the attacker cannot reach office computers or servers. This is standard in the networks we design.

Responsibilities in a business

Quick answers