13,481 CCTV Recorders With Known Flaws Found in 39 Countries

Devices seen open between 30th September and 30th October 2026.

Finding 1: Cameras With Flaws That Are Years Old

Most cheap CCTV recorders run on a handful of chip platforms and white-label firmware, then get sold under hundreds of brand names worldwide. When a flaw is found in that firmware, it shows up in all of them at once, and few brands ever ship a fix.

The largest group, 12,655 recorders, run firmware for HiSilicon-based hardware with a local file inclusion flaw, the kind that lets an attacker read files off the device and possibly run code on it. Flaws in this firmware family were widely reported back in 2020, including a hidden remote-access mechanism that Huawei, whose HiSilicon unit designs the chips, said the device makers introduced rather than its own software.

The second group, 826 recorders, are vulnerable to CVE-2018-9995, a flaw in TBK recorders and the many brands that resell them. A crafted request makes these devices return user accounts and passwords. The scan confirmed that all 826 are affected. The flaw has been public since 2018.

An exposed recorder is a privacy problem first: live and recorded video of a shop floor, a driveway, or a living room. It is also a foothold. A compromised recorder sits inside the home or office network, next to laptops and phones, and attackers have recruited recorders like these into botnets for years.

Finding 2: Where in the World the Cameras Are

Asia holds 54% of the vulnerable recorders (7,339) and Europe 32% (4,257). South America has 1,002, North America 589, Africa 237, and Oceania 57.

Share of each device class by continent.

One country dominates: South Korea has 4,169 vulnerable recorders, 31% of everything we counted, more than the next three countries together: Russia (1,899), Türkiye (714) and Brazil (583). Taiwan (578), Iran (531) and Vietnam (411) complete a list in which the United States, with 361, is only eighth. In the European Union, Italy (303) and Poland (301) have the most, though Bulgaria and Romania are far more exposed per person.

Countries and networks with the most vulnerable recorders.

A recorder is a physical box on someone's premises, so its address belongs to whoever provides that building's internet connection. That is why the network list reads like a directory of the world's broadband providers: Korea Telecom (2,426), SK Broadband (759), Turk Telekom (546), LG U+ (480), Chunghwa Telecom in Taiwan (417), Rostelecom (390) and Iran Telecom (332). Nine of the ten are telecoms, and together they carry 43% of all the vulnerable recorders on earth.

Raw counts favor big countries, so for the 40 countries we broke out individually, we also divided by population. Among those with at least 100 vulnerable recorders, South Korea has 80.7 per million people, followed by Bulgaria (40.9), Romania (14.9), and Russia (13.2). 

The United States has 1.1, Japan 1.2, and Mexico 0.9. China, where the chips inside most of these recorders are designed, shows just 49, or 0.03 per million. We can't tell from this data whether that reflects fewer vulnerable devices or less of China's address space being visible from outside.

Vulnerable recorders per million people, for the countries among the 40 we broke out that have at least 100. Population: World Bank, 2025. Taiwan isn't covered by the World Bank data.

Finding 3: The Storage Box In the Cupboard

1,207 QNAP network storage devices were reachable and running firmware affected by CVE-2024-21899, an authentication flaw rated 9.8 out of 10 that QNAP patched in March 2024. More than two years on, 65% have been exposed for more than six months. 

Asia holds 45% and Europe 42%: China (148), Taiwan (140), Italy (125), Germany (90) and South Korea (68) lead. The biggest clusters sit on home and small-business broadband: Chunghwa Telecom in Taiwan (123), Deutsche Telekom (67), China Telecom (64) and Korea Telecom (42).

These boxes hold family photos, small-business accounts and backups. The DeadBolt ransomware campaign also targeted them, locking thousands of NAS devices in 2022 and leaving a ransom note on their login page. No NAS box seen in the last 30 days still showed that note; today's exposure is the unpatched login flaw, not an active ransom campaign.

File sharing is broader and messier. 50,556 Windows or Samba file shares listed their folders to a guest login, 39% in Europe, 32% in Asia and 18% in North America. The United States (6,852), France (3,614), Russia (3,197), Germany (3,129) and Taiwan (3,128) lead. Some are home NAS boxes, and many are business servers, so we report this number separately from the home figures.

Finding 4: The Smart Home's Message Bus

MQTT is the protocol that smart plugs, thermostats, alarm panels, and industrial sensors use to talk to a central hub. Whoever can connect to the hub can usually read every message passing through it and often send commands. 8,078 MQTT brokers accepted connections with no login, and 80% have done so for over six months.

They're spread across three continents: Asia 40%, Europe 38%, North America 20%. The United States has the most (1,489), followed by South Korea (1,302), Germany (669), China (613) and France (376). In South Korea, most sit on home and business broadband from Korea Telecom (653) and SK Broadband (286); elsewhere, many are on cloud servers.

The raw count was far larger, 42,919, but 34,841 of those were brand-new addresses at a single cloud provider, spread across its data centers worldwide and all first seen within the same month. That pattern points to research sensors, the decoy machines security companies run to watch attackers, so we left them out.

Top five countries for storage boxes, MQTT brokers, file shares, and Remote Desktop.

Finding 5: Screens Anyone Can Watch

VNC is remote-desktop software: whoever connects sees the screen and controls the mouse and keyboard. 562 VNC servers and 611 browser-based noVNC desktops asked for no password at all. The VNC servers are scattered across well over a hundred networks, from hosting companies to home broadband; the noVNC desktops cluster on rented servers at Hetzner, DigitalOcean and OVHcloud. Another 251 Android devices, more than half on cloud servers, left the Android Debug Bridge open, giving a stranger command-line access to the device.

Windows Remote Desktop without Network Level Authentication adds 3,192, and it's the one category concentrated in the West: 64% are in Europe and 29% in North America, led by the United States (849), France (561) and Germany (479). These are mostly rented servers, and 94% have been exposed for more than six months.

Remote desktops and Android debug interfaces, last 30 days.

What a Second Search Engine Sees

IoT search engines don't see the same internet. Each scans different address ranges on its own schedule, keeps records for a different length of time, and runs its own checks, so no single engine gives a complete count. To test the scale of our figures, we ran the four exposures that a second engine can detect with its own checks through that engine on 3rd November 2026, and kept only its totals and breakdowns.

The second engine lists 209,856 message brokers that accepted a connection with no login, 26 times our count; 6,477 VNC desktops with authentication switched off, 12 times ours; 4,362 open Android debug ports, 17 times ours; and 155,013 file services that answer without authentication, 3 times ours.

The same places lead in both: South Korea is first or second for message brokers in each engine, and the United States tops both lists for VNC desktops (62% of the second engine's).

Two of the second engine's blocks are striking on their own. 141,963 of its open message brokers, 68% of the world total, sit on one South Korean provider, SK Broadband, and 84,109 of its open file services (54%) sit on one Pakistani telecom. 

Concentrations that size are rarely thousands of separate decisions; they look like a single product deployed at scale with a port left open, the same pattern as the Korean recorders in Finding 2 on a larger canvas. The second engine has no check for the two recorder flaws in this study, so there's no second count for the cameras themselves.

Why the Devices End Up There

Few of the home devices in this study were put on the internet on purpose. They arrive there through port forwarding set up by an installer, through UPnP, the router feature that lets a device open its own port without asking, or through firmware that listens on every interface by default. 

Once a device works, nobody has a reason to log back in, and cheap hardware often stops getting updates long before it stops working. None of that is specific to one country, which is why the same devices show up from Seoul to São Paulo.

Methodology

We counted devices in an IoT search engine that runs checks for specific, published flaws against devices reachable on public IP addresses. We counted records the engine had last seen between 30th September and 30th October 2026. A record is one device address and port that failed one check. 

For each count, we kept only the total and the engine's breakdowns by country, continent and network operator. For four exposures, we also queried a second IoT search engine on 3rd November 2026 and kept only its totals and breakdowns.

We never scanned, connected to, or logged in to any device, and we stored no IP address or hostname. We excluded suspected research-sensor records from the MQTT count as described above; the other device categories showed no such pattern. Population figures for the per-capita comparison come from the World Bank (2025).

Limitations

Home connections often change address. A device whose address changed during the month can be counted twice, which inflates the totals; at the same time, the engine doesn't see every address, which deflates them. Country rankings rely on IP geolocation. File shares and remote desktops include business servers. The full definitions are in the methodology.

What To Do

• Check your router: Review the port-forwarding list and disable UPnP unless you know you need it. Any rule you did not create, or no longer need, should go.
• Don't expose a recorder or NAS to remote access: Use a VPN into your home network, or the vendor's relay service, instead of an open port.
• Update or replace: If your recorder's maker no longer ships firmware, the safe option is a supported model. For QNAP, install the current firmware; the 2024 fix has been available for a long time.
• Lock the smart-home hub: An MQTT broker should require a username and password and, ideally, listen only on the local network.
• Turn on Network Level Authentication for Windows Remote Desktop, and never run VNC without a password.
• Broadband providers can help: Many already receive free daily reports of vulnerable devices on their networks from organizations such as the Shadowserver Foundation. Because a handful of large providers carry so many of these devices, passing those warnings on to customers would reach a large share of them.

Summary

Somebody installs a camera system in a corner shop or a family home. To check the feed from a phone, the installer opens a port on the router. The recorder works, the owner is happy, and nobody touches the firmware again. Years later, the box is still there, still answering anyone who asks, running software with flaws published long ago.

We wanted to know how many of those boxes are out there, and where. We counted them in an IoT search engine, a commercial service that scans the whole internet, indexes every device that answers, and tests devices for specific, published flaws. We looked at what it had seen in the 30 days to 30th October 2026, then checked the scale of four of the exposures against a second IoT search engine. We didn't scan or contact a single device ourselves.

13,481 CCTV recorders came back running firmware with known flaws, spread across every inhabited continent. 58% of them have been exposed for more than six months.