A five-year-old Hikvision bug is being hammered in Ukraine. Your cameras are the lesson

By Verona - Published: 9 October 2026

Security reports about cameras in a war zone invite big conclusions, and the new GreyNoise write-up is notable for how carefully it avoids them. GBHackers summarises what the firm saw: a nine-day burst of attempts to exploit an old Hikvision flaw, from 23 September to 1 October, while Russian missile and drone strikes were hitting Ukraine.

What was actually observed

The target was CVE-2021-36260, a command injection in the web server of certain Hikvision cameras and recorders. NIST scores it 9.8; it needs no login and no user action; and it has been in CISA's Known Exploited Vulnerabilities catalogue for years. After some probing on 21 September, traffic jumped from nearly nothing, and four IP addresses accounted for almost all of it. Each request carried the same harmless test command, with no attempt to install anything. The attackers used a public Nuclei template for the flaw, so no special skill was involved. Three of the addresses were PureVPN exit nodes in Lithuania; the fourth was on a Ukrainian network. All four went quiet after 1 October.

GreyNoise says plainly that it could not link the activity to the strikes. A shared VPN exit carries other people's traffic, so a common address does not show a common operator, and nothing in the data shows footage being taken or a camera being taken over. It saw attempts. It did not see compromises.

Why the caution is the useful part

It would be easy to write this up as a Russian surveillance operation, and it may be one. But the practical lesson for anyone who owns cameras does not depend on attribution. A five-year-old critical bug is still being scanned for because enough devices have never had the firmware update. The people who run cameras at petrol stations, warehouses, schools and car parks are rarely the people who run patch cycles. That gap exists in every country, not just one with a war in it.

What to do with your own estate

• Count the cameras and recorders you actually have. Ask facilities, not just IT, because the box on the loading dock was often bought and installed by someone else.
• Check each one against Hikvision's firmware for CVE-2021-36260 and update. If a model is out of support and cannot be fixed, replace it or isolate it.
• Take them off the internet. If staff need to view footage remotely, put a VPN or a vendor cloud service with proper authentication in front rather than a forwarded port.
• Put cameras on their own network segment with no route to business systems, since a recorder is a Linux machine that can pivot.
• Search your logs and your firewall for inbound requests to camera web ports from the addresses GreyNoise published, and treat any success as a reason to reset and reflash the device.
• Do not read "the campaign seems to have stopped" as a sign you are safe. The same template will work next month against anything left unpatched.

Sources beyond the summary above: the vulnerability is listed in CISA's catalogue, which is the place to check for the remediation guidance. For help finding the devices nobody remembers owning, write to sales@halfteck.com.