Is My Factory CCTV Hackable? CERT-In Vulnerability Notes by Brand, 2023–2026

Has India's cyber agency flagged your CCTV brand? As of 17 Oct 2026, CERT-In had published 17 vulnerability notes on CCTV cameras, NVRs, DVRs, video storage and video software between January 2023 and October 2026, covering ten brands. Five are rated CRITICAL. Sixteen of the 17 point to a firmware update or vendor patch. One camera, D3D's D8801, has no fix because it is end-of-life.

Last checked: 17 Oct 2026

By the Mama Editorial Team. Every row below comes from a CERT-In vulnerability note (numbered CIVN-YYYY-NNNN) on cert-in.org.in, read note by note. We list what each note says. We do not rate brands.

Key takeaways

• 17 CCTV-related CERT-In notes in 2023–2026, per CERT-In's vulnerability-note archive (checked 17 Oct 2026). By severity as CERT-In states it: 5 CRITICAL, 8 HIGH, 4 MEDIUM.
• Brands named (A–Z): Bosch (1 note), CP Plus (4), D3D Security (1), Dahua (2), Hikvision (2, both on storage and management software, none on cameras or NVRs), Honeywell (1), Milesight (1), TP-Link (3), Ubiquiti (1, the UniFi OS that runs its UNVR/ENVR recorders) and Uniview (1).
• The fix is almost always firmware. 16 of 17 notes point to a firmware update or vendor patch. The exception, CIVN-2024-0314, says the product reached end of life in January 2024.
• No note found for Prama, Axis, Hanwha, Sparsh, Godrej, Secureye, Hi-Focus, Zicom, i-PRO or Matrix cameras (checked 17 Oct 2026). That is a statement about CERT-In's archive, not a security rating.
• A note count is not a security score. Seven of the 2023 notes credit the same Karnataka research team, so the count reflects who was testing which brand as much as anything else.

Verified against

• CERT-In vulnerability notes, individual pages https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=<CIVN>. We opened every note numbered CIVN-2023-0001 to CIVN-2023-0397, CIVN-2024-0001 to -0360, CIVN-2025-0001 to -0390 and CIVN-2026-0001 to -0507. That is 1,643 of 1,654 notes. Eleven pages (CIVN-2023-0215 to -0224 and -0226, July–August 2023) did not load after repeated attempts. Checked 17 Oct 2026.
• CERT-In year lists: Vulnerability Notes. The highest numbers listed were CIVN-2023-0397, CIVN-2024-0360, CIVN-2025-0390 and CIVN-2026-0507 (checked 17 Oct 2026).
• BIS Registration Department, Guidelines for implementation of "Essential Requirement(s) for Security of CCTV", 22 Oct 2024, with MeitY's series guidelines attached.
• MeitY Office Memorandum W-18/26/2025-IPHW, 16 Jan 2026.
• The vendor advisories each note links to: Hikvision SAN, HikCentral, Bosch, Uniview, TP-Link VIGI and TP-Link Kasa. All opened 17 Oct 2026.

CERT-In CCTV vulnerability notes, January 2023 to October 2026

The table is in date order. Severity, models and fixes are as CERT-In states them. The full rows, including firmware ranges and CVE numbers, are in the CSV download.

Brands with no CCTV note found

"None found" means none among the 1,643 notes we read. We left out notes on routers, NAS boxes and smart hubs, even where the brand also sells cameras. It does not mean the product has no known flaw. Vendors also publish their own security advisories, and global databases list CVEs that CERT-In never turns into a note.

Where brands differ

What kind of device is named. Most notes cover the camera itself. Three cover the recorder: CP Plus NVRs, Milesight NVRs and Ubiquiti's UniFi OS, which CERT-In lists for UNVR and ENVR recorders as well as network gateways (CIVN-2026-0291). One covers a CP Plus DVR. Both Hikvision notes are about back-end products: SAN storage and the HikCentral management software. In a factory, the recorder and the management software are what the whole system depends on.

Remote versus hands-on. Most notes describe attacks over the network, usually through the device's web interface. Three are not open to a remote attacker on the internet. The CP Plus Ezykam note says an attacker "with physical access" could read keys and Wi-Fi credentials over the UART port (CIVN-2026-0266). The Tapo C500 note says the same about a hard-coded RSA key (CIVN-2025-0017). For the Kasa EC70/EC71, the attacker has to be on the same local network (CIVN-2026-0372). The CP Plus EZ-P21 note is mixed: its code-execution flaw needs physical access, while the snapshot flaw is reachable over HTTP (CIVN-2026-0380).

Password recovery is a repeat weak spot. The Honeywell note describes an attacker changing the admin recovery email without logging in, leading to account takeover and access to "live and recorded surveillance feeds" (CIVN-2026-0098). The TP-Link VIGI note describes an authentication bypass through the password-recovery feature of the local web interface (CIVN-2026-0041). Milesight's NVR note cites a "weak password reset mechanism" (CIVN-2023-0121).

How the fix is delivered. CP Plus notes name exact firmware builds, and the two 2026 camera notes say the update comes over the air: through the Ezykam+ app for Wi-Fi cameras, and OTA to 4.8.16.1 for the EZ-P21. Dahua, Hikvision, Bosch and Uniview notes point to the vendor's own security advisory. Bosch's note also gives a workaround: block connections from untrusted networks and allow-list trusted IPs (CIVN-2023-0190).

Who found the flaw. Seven notes from 2023 credit Souvik Kandar and Arko Dhar of Redinent Innovations, Karnataka: Dahua, Hikvision SAN, Milesight, Bosch, two CP Plus and Uniview. The 2026 CP Plus EZ-P21 note credits student researchers from Vignan University, SRMIST Ramapuram and IIIT Allahabad (CIVN-2026-0380). Brands that Indian researchers test more often will show up more often in CERT-In's archive.

Why the STQC/BIS security test exists

India now requires a security test before a CCTV camera model can be registered and sold. MeitY notified the "Essential Requirement(s) for Security of CCTV" on 9 April 2024 under the Compulsory Registration Order, with 9 April 2025 as the last date of implementation, per the BIS implementation guidelines of 22 Oct 2024.

The BIS guidelines say third-party laboratories issue the test reports. Each "series" of cameras must share the same System-on-Chip and identical firmware "with matching hash values". If a series runs more than one software version, each version "must be tested separately". The guidelines also require a software bill of materials that lists open-source libraries and "security features as per ER". After 9 April 2025, BIS grants no new CCTV camera licence without ER compliance.

MeitY's Office Memorandum of 16 Jan 2026 withdrew the stock-clearance relaxation. From 1 April 2026, "no sale of any CCTV cameras, which do not conform to ERs" is allowed. What this means for cameras already on your walls is covered in Do I have to replace my CCTV in 2026?. Which models passed is covered in the STQC/BIS approved list explained.

Note the limit. The ER test certifies a specific firmware version, identified by its hash. A flaw found later in that firmware is fixed by a newer firmware version, and that is the fix nearly every note above names.

What breaks in a factory

• Recorders that never get updated. An NVR or DVR in a panel room often runs the firmware it shipped with. The CP Plus DVR and NVR notes and the Dahua XVR/NVR ranges are exactly this kind of box.
• Port-forwarding for remote view. Nearly every remote-attack note works through the web management interface. That interface becomes reachable from outside when someone forwards a port so the owner can watch from home. See Remote viewing behind Jio/Airtel CGNAT for options, and the unsecured feeds audit checklist for the check itself.
• Consumer Wi-Fi cameras on the shop floor. Tapo, Kasa and Ezykam-type cameras sometimes get bought locally for a store room or gate. Three of the 17 notes are about Wi-Fi cameras like these.
• End-of-life hardware. CERT-In's D3D note says plainly that the product "is no longer supported" and recommends discontinuing or replacing it (CIVN-2024-0314).
• Changed timestamps. Two notes (Dahua 2023, CP Plus DVR 2023) are about remote changes to the device clock. A wrong timestamp weakens footage as a record of when something happened.
• Door controllers and attendance terminals. These sit on the same network. CERT-In has notes on the Matrix COSEC door controller and the ZKTeco WL20 biometric attendance system (firmware ZLM31-FXO1-4.0.3 fixes two of its four flaws; for the other two the note advises vendor mitigations or discontinuing use).

When to call the installer / what to ask the vendor

Start with the 20-minute self-audit to list every camera and recorder by model. Then match the model numbers against the table above.

Questions to put to the installer or vendor, in writing:

1. What firmware version is each recorder and camera running, and is it at or above the version in the CERT-In note?
2. Is any port forwarded to the NVR, DVR or a camera?
3. Is UPnP switched off on the recorder and the router?
4. Do we hold the admin password, or only the installer? See getting admin rights at handover.
5. Is any model past the vendor's end-of-support date?

Who decides what counts as a fix is the vendor and CERT-In. This page is not legal or security advice.

Where Mama fits

Mama reads the cameras a factory already has, over RTSP or ONVIF on the local network, and sends the owner a short morning note on where machine hours went idle. It needs no port opened to the internet. More at askthemama.com. Leave an email or phone in the form below.

FAQ

Does CERT-In publish advisories about Hikvision cameras? In CERT-In's vulnerability notes from January 2023 to 17 Oct 2026, no note names a Hikvision camera or NVR. Two notes name Hikvision products: Hybrid SAN and Cluster Storage (CIVN-2023-0106, HIGH) and HikCentral software (CIVN-2025-0205, HIGH).

Has CERT-In flagged CP Plus cameras? Yes. Four notes cover CP Plus video products: an NVR and a DVR (14 Aug 2023), Ezykam Wi-Fi cameras (25 May 2026, MEDIUM) and the EZ-P21 IP camera (27 Jul 2026, CRITICAL). Each names a firmware fix. CERT-In lists the vendor as Aditya Infotech Limited (Brand CP-Plus).

How do I check if my CCTV has a known vulnerability in India? Note the exact model and firmware version from the recorder's menu or web page. Then search CERT-In's vulnerability notes and the vendor's security-advisory page for that model. The CSV of this table has the full model and firmware lists.

Does an STQC-certified camera mean it cannot be hacked? No. Per the BIS guidelines of 22 Oct 2024, the security test covers a specific firmware version identified by its hash value. Flaws found after testing are fixed by firmware updates, which the owner or installer still has to install.