Over 67 million cyberattack attempts targeting Hikvision cameras were detected across UK networks in 2025, representing 20% of all high-severity intrusion alerts.
A four-year-old vulnerability (CVE-2021-36260), despite being patched in 2021, continues to drive the highest attack volume, alongside hundreds of thousands of attempts on routers like the TP-Link AX21.
The issue is not outdated CVEs alone, but network architectures that still expose devices directly to the public internet, making them easy targets for botnet recruitment.
In the 24 hours since Cybernews and SonicWall published the figure, 67 million attacks, this has been the most arresting cybersecurity headline in the UK trade press this month.
The number is striking, but the more useful detail is in the breakdown: the campaign is not a sophisticated zero-day. It is the persistent exploitation of CVE-2021-36260; a four-year-old command injection flaw in Hikvision cameras that Hikvision themselves patched in September 2021. For installers, integrators, ARCs and asset owners running CCTV anywhere in the UK or Ireland, this is not new news. It is the same news, restated. What has changed is that the data is now too large to ignore.
What The SonicWall Numbers Actually Show
According to SonicWall’s reporting, more than 67 million attempted attacks on Hikvision cameras across UK networks were recorded during 2025, of which the overwhelming majority were automatically blocked. The attack made up 20% of all medium and high-severity IPS alerts, the company saw in the UK over that period.
CVE-2021-36260 itself is well-understood. The flaw is a command injection vulnerability in the embedded web server of around 70 Hikvision IP camera, PTZ camera and NVR models. Exploitation requires no authentication and no user interaction. An attacker who can reach the camera’s HTTP or HTTPS port can execute arbitrary commands as root, take full control of the device, and use it as a foothold for whatever comes next. CISA added the flaw to its Known Exploited Vulnerabilities catalogue in early 2022. Mirai-based botnets, including Moobot, have been actively recruiting through this CVE since late 2021.
Alongside the Hikvision numbers, SonicWall also recorded over 600,000 attack attempts against TP-Link AX21 home routers across nearly 2,000 firewalls. The pattern is consistent: cameras and consumer-grade routers are now permanent fixtures on the attacker’s hit list.
Why This CVE Has Not Died in Four Years
The vulnerability was patched in 2021. Patches have been freely available for four years. So why is this still the single most common serious IPS event on UK networks in 2025?
The honest answer is that patching is not the variable that determines whether a site is at risk. The architecture is. Three structural realities keep cameras like these reachable to attackers years after the patch:
- The camera is exposed to the public internet. A port forward on the customer’s router, often added at install time for “convenient” remote viewing, makes the camera’s HTTP server reachable from anywhere in the world. Once that path exists, every internet host is on the LAN.
- Nobody owns the patching. Cameras are routinely classified as facilities equipment rather than IT equipment. The IT team does not patch them; the installer assumes the customer does; the customer assumes the installer does; the camera continues running 2021 firmware in 2026.
- The camera is on a flat network. Even where the camera itself is not directly internet-reachable, it shares a LAN with whatever else lives on the customer’s network. Once an attacker reaches the camera through any other route, the rest of the network is reachable too.
Each of these is an architectural property, not a configuration setting. None of them is fixed by another firmware update.
The Architectural Answer
The Hikvision numbers fit a wider pattern. Other 2026 CCTV disclosures, including Fortinet’s analysis of the Nexcorium Mirai variant against TBK DVRs and TP-Link’s CVE-2026-0629 in the VIGI camera range, all describe the same underlying problem. The vendors and the CVEs change. The architecture that makes them exploitable from the public internet does not.
The architectural answer is consistent in every case:
- Cameras on a dedicated VLAN, with port isolation on managed switches. A compromised camera cannot reach its neighbours at Layer 2, only the i-ctrl as the default gateway. Lateral movement is denied at the network layer, not just the policy layer.
- A separate trust zone for the CCTV plane. With our Dual Static IP feature on the i-ctrl, the camera plane sits on its own independent public IPv4 address, with no Layer 3 path to the OT network, the corporate IT network or any other system on the same site. A compromise at the camera does not become a compromise at the SCADA controller, the payment terminal or the file server.
- Off-device logging. Authentication and configuration events on the connectivity layer are logged back to the Netcelero customer portal in our core network in Dublin and Amsterdam. Even if a camera is compromised and reset, the trail of events that led up to the compromise survives.
A site built like this does not produce 67 million attack attempts in any vendor’s quarterly report, because the attacker cannot reach the camera in the first place
What We Would Recommend Right Now
If you operate or maintain CCTV anywhere in the UK or Ireland in 2026, a action we recommend is to review SonicWall’s published list of affected Hikvision models or any equivalent vendor advisory to identify any camera, NVR or DVR in your estate that is currently reachable on the public internet, regardless of whether it has been patched.
The patch is not the issue; the reachability is. Then, for any site that still has a camera management interface exposed, get the architecture changed before you get the firmware changed.
The Netcelero engineering team works with installers, integrators, MSPs and ARCs across the UK and Europe to design CCTV connectivity that holds up to the next CVE, not just the last one. If you want to walk through your existing estate against the architectural pattern that would have prevented those 67 million attempts, please talk to your Netcelero account manager, or contact our team directly.
