If your CCTV system still has its web interface reachable from the internet, you don't have a camera system — you have an open door with a lens attached. 2025 and 2026 have been rough years for surveillance vendors, and the vulnerabilities disclosed weren't theoretical lab findings. They were remotely exploitable, unauthenticated, and in some cases affected devices already installed in shops, villas, and offices across the Gulf. Let's skip the "change your default password" lecture — most of you already did that. This is about the newer, uglier stuff.

Three vulnerability classes that changed the game

What makes the last year different isn't the number of bugs — vendors always have bugs. It's the pattern: unauthenticated remote code execution on a mainstream brand, an authentication bypass that hands over the entire account without a password, and a wave of white-label cameras where nobody quite knows who's responsible for the patch. Here's each one, and what it means for a typical installed system.

Case 1: Dahua ONVIF buffer overflow + file-upload RCE (CVE-2025-31700)

Dahua confirmed a stack-based buffer overflow in the ONVIF handler running on port 80 — the same port most installers leave forwarded so the client can "check the camera from home." The bug sits in how the device parses the Host header, and it can be triggered without any login at all. Combined with a file-upload flaw in the same protocol stack, an attacker doesn't need credentials to hijack the device; they need the port open. Dahua later confirmed this wasn't a one-model issue — 126 camera models across the IPC, SD, and DH series were affected, far more than initially reported. If you've got any Dahua device older than the fixed builds and its web port is exposed, treat that as a live incident, not a maintenance item.

Case 2: Honeywell CVE-2026-1670 — the login screen that doesn't matter

This one is nastier in a quieter way. CVE-2026-1670 lets an unauthenticated remote attacker change the recovery email address tied to a Honeywell camera account. Once the recovery email is theirs, the login screen is decorative — they trigger a password reset, take the account, and now they own the feed, the settings, and whatever else that account controls. Researcher Souvik Kanda flagged it as a "missing authentication for critical function" issue, and it carries a CVSS score of 9.8 — about as severe as these ratings get. CISA's advisory on the affected Honeywell HIB2PI and HDZ series cameras confirms the same root cause: an unauthenticated API endpoint that should never have been reachable without a login in the first place. The lesson here isn't "pick a stronger password" — a strong password is irrelevant against an account-recovery bypass. It's about whether the device exposes admin-level API functions to anyone who can reach it on the network.

Case 3: The white-label problem

CISA also published an advisory covering multiple India-based CCTV camera brands in early 2026, and it's part of a broader, uncomfortable pattern: a huge share of the cameras sold under local or regional brand names are OEM units manufactured by a handful of factories, then rebadged. When a vulnerability is found in the underlying hardware or firmware, the advisory often names the OEM — but the box on your wall says something else entirely. If you can't tell your installer which chipset or ODM built your "brand X" camera, you have no way to know whether a given advisory even applies to you. That's exactly why the hardening steps below matter more than brand loyalty.

The hardening checklist to run this week

Patching is ideal, but in the real world half these systems won't get an official firmware update for months, if ever. So do this regardless of what firmware you're on:

• Kill UPnP on the router. UPnP is what let the camera punch its own hole in your firewall without you noticing. Turn it off at the router level, not just the camera settings.
• Remove port forwarding rules for camera web interfaces. If you need remote viewing, do it through a VPN into your own network, not a forwarded port sitting open to the entire internet.
• Put every camera and NVR on its own VLAN. CISA's own guidance on securing network infrastructure devices is blunt about this — logical segregation, physical or virtual, is one of the most effective ways to limit what an attacker can reach if a device is compromised. A camera on the same flat network as your accounting PC is a liability, full stop.
• Disable P2P and cloud auto-discovery features unless you have a specific business reason to use them. These are exactly the kind of convenience features that quietly open outbound tunnels you didn't ask for.
• Check firmware build dates against the vendor's advisory. For Dahua Hero C1 devices specifically, Bitdefender confirmed the fix landed in firmware released after 16 April 2025 — anything older is still vulnerable. Don't just check the version number; check the actual build date.
• Restrict ONVIF and RTSP to LAN-only, authenticated access. These protocols were never designed to be internet-facing. If your NVR software needs ONVIF to talk to cameras, that traffic should never leave the VLAN.
• Monitor for unauthorized account or recovery-email changes. Given the Honeywell flaw, this is now a legitimate item on a security checklist, not paranoia. If your camera platform sends account-change notifications, make sure they're actually going to an address you check.

Check if you're already exposed

Before you assume your setup is fine, verify it. A widely cited study using Shodan and Censys queries against well-known surveillance manufacturers found more than 1 million cameras and over 125,000 surveillance servers openly exposed to the internet — and 90% of them had no HTTPS on their login portal at all. That's not a fringe statistic; that's the default state of a huge share of installed CCTV systems worldwide, and there's no reason to assume Gulf installations are meaningfully better. Search your public IP address on Shodan.io. If your camera's web login or RTSP stream shows up in the results, it's reachable by anyone, not just you. That alone tells you whether UPnP or an old port-forward rule is still active.

Quick reference: what's broken and what to do about it

• CVE-2025-31700 — Dahua, 126 models across IPC/SD/DH series. Fix: update to firmware released after the vendor's confirmed patch date; if you can't patch immediately, block port 80 externally and disable UPnP now.
• Dahua Hero C1 issues — Fix confirmed in firmware builds after 2025/04/16 per Bitdefender testing. Check your build date, not just the version string.
• CVE-2026-1670 — Honeywell HIB2PI and HDZ series, CVSS 9.8, account takeover via unauthenticated recovery-email change. Fix: apply the vendor patch referenced in CISA advisory ICSA-26-048-04; until then, isolate the device from the internet entirely and monitor account activity manually.
• White-label/India-based brands — Covered under CISA advisory ICSA-25-343-03. Fix: identify the actual OEM/chipset behind your branded camera and cross-check it against current advisories, don't rely on the storefront brand name.

Do one thing today: log into your router and check whether UPnP is on and whether there's a forwarding rule pointing at your NVR or camera's web port. If there is, that's your exposure — close it before you worry about anything else on this list.

References

• Dahua Camera flaws allow remote hacking. Update firmware now | Security Affairs
• Over 100 Dahua CCTV cameras exposed to takeover risk | TechRadar
• Critical Dahua Camera Flaws Enable Remote Hijack via ONVIF and File Upload Exploits | The Hacker News
• Vulnerabilities Identified in Dahua Hero C1 Smart Cameras | Bitdefender Labs
• CISA Warns Honeywell CCTV Vulnerability Enables Account Takeovers | Cyber Press
• Critical infra Honeywell CCTVs vulnerable to auth bypass flaw | BleepingComputer
• Honeywell HIB2PI and HDZ Series CCTV Cameras (Update B) | CISA ICS Advisory
• Multiple India-based CCTV Cameras (Update A) | CISA ICS Advisory
• The Security of IP-Based Video Surveillance Systems | PMC/NCBI
• Securing Network Infrastructure Devices | CISA

Image: torkildr — BY-SA (via Openverse)