Topic starter
23/10/2026 12:46 am
TL;DR: For GreyNoise, a nine-day surge of scanning and exploitation attempts hit Hikvision DVR and camera targets in Ukraine, mostly tied to CVE-2021-36260. Surveillance networks now need to be treated as exposed infrastructure that can aid reconnaissance as well as intrusion.
Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Spike in Attacks Targeting Digital Video Recorders in Ukraine”.
By the numbers:
- GreyNoise saw a nine-day surge of exploitation attempts between 21 September and 1 October 2026.
- The activity centred on CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.
Key questions
Q: Why do exposed surveillance devices create more than cyber risk?
A: Because cameras and DVRs can reveal movement, layouts, response timing, and other information that is useful outside the network.
Q: What are the signs that DVR exploitation attempts are becoming targeted?
A: Look for a sudden increase from a low baseline, repeated requests against the same device family, and a small number of sources driving most of the traffic.
Q: What breaks when internet-exposed DVRs are not patched or isolated?
A: They stop behaving like passive building equipment and become remotely exploitable endpoints.
Practitioner guidance
- Inventory exposed surveillance devices Build a current list of all internet-facing DVRs, NVRs, and IP cameras, including model, firmware, owner, and business location.
- Eliminate unnecessary public reachability Remove direct internet exposure for video systems where business operations do not require it.
- Patch and retire vulnerable Hikvision estates Track firmware versions for device families known to accept unauthenticated command injection and remove unsupported units from service.
Bottom line: Exposed DVRs and cameras can become both cyber footholds and physical reconnaissance tools when patching and access controls lag.
Glossary terms: Internet-Exposed Surveillance Device, Unauthenticated SQL Injection, Reconnaissance And Exploitation, Device Lifecycle Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Surveillance devices are now governance assets, not peripheral hardware. Once DVRs and cameras sit on the internet, they become part of the security boundary and should be governed accordingly. Their compromise can affect both cyber and physical risk, which means inventory, exposure reduction, and patch accountability matter as much as the device's operational role. Practitioners should treat video infrastructure as a managed access surface, not a facilities exception.
A question worth separating out:
Q: How should organisations reduce the attack surface of surveillance infrastructure?
A: Remove direct internet exposure wherever possible, place administrative access behind controlled paths, and segment video networks from business systems. Then maintain firmware visibility and decommission unsupported devices. The aim is to make compromise materially harder and to limit what a successful exploit can observe or reach.
👉 Read our full editorial: DVR exploitation spikes in Ukraine as war activity intensifies
This post was modified 6 days ago by NHI Mgmt Group