Key takeaways

  • Cameras and network video recorders (NVRs) are ordinary networked computers with weak defaults. CISA notes that owners of network devices often do not change vendor default settings, harden them or patch them regularly.
  • Change every default username and password at install, and give each device its own strong credential kept in a password manager.
  • Keep firmware current and retire products the maker no longer supports. Known exploited vulnerabilities in the CISA catalog often include camera and recorder products.
  • Turn off peer-to-peer (P2P) or cloud-relay features and UPnP unless you have chosen a specific remote-viewing method. They open paths to the internet that you did not design.
  • Put cameras and the recorder on their own VLAN, allow only the traffic they need, and never forward a port from the internet to a camera or recorder.
  • Remote viewing should go through a VPN or a vendor service you have reviewed, not through an open port.

Why cameras get attacked

A security camera is a small Linux computer with a lens. A network video recorder, NVR, is a larger one that stores video. Both are on your network around the clock, both are usually installed once and forgotten, and both have often shipped with a well-known default login. Attackers scan the internet for exactly these devices, take them over, and then use them for spying, as a foothold on your network or as part of botnets.

CISA's guidance on securing network infrastructure devices says the same about network gear in general: owners often do not change vendor default settings, harden devices, or patch regularly, and devices are often overlooked when investigating an intrusion. A camera is the same kind of forgotten device.

1. Replace every default credential

  • Change the default username and password on every camera and the NVR when you install, before connecting to the main network if you can.
  • Use a different strong password for each device, or at least for each site, stored in a password manager rather than on a sticky note in the equipment closet.
  • Disable shared admin accounts and any guest or demo accounts the product creates. Give the installer and the property team separate named logins.
  • Do not reuse the Wi-Fi, email or building-system password.

2. Firmware and support

Cameras do not update themselves in most small installations. Put each device and its firmware version in a simple list, check the maker's site on a schedule, and apply updates in a quiet period, one site at a time, so you can roll back. CISA's patching guidance explains why: updates fix flaws that are being used against people. The CISA Known Exploited Vulnerabilities catalog is a free list of flaws seen exploited in the wild; searching it for your camera and recorder brands is a useful ten-minute check.

If the maker has stopped issuing updates for a model, plan to replace it. An unsupported camera that cannot be fixed should not be reachable from anything except a locked-down camera network, and the better answer is a replacement.

3. Switch off the shortcuts

Many consumer-style and low-cost systems ship with peer-to-peer or cloud-relay features: a QR code and an app, no router changes needed. That ease works because the device reaches out to the vendor's servers and the vendor brokers the connection. You may not control that service, its patching, or who at the vendor or a reseller can reach your video. For a business or a rental property, turn these features off unless you have read the vendor's security terms and chosen them on purpose.

Also disable Universal Plug and Play, UPnP, on your router. CISA's home network guidance calls UPnP a security risk, because devices on your network can ask the router to open ports on their own, and says to disable it unless you have a specific need. The same advice applies at a small office.

While you are in the menus, turn off the services you do not use, such as Telnet, unneeded web interfaces, and old discovery protocols, and enable encrypted management (HTTPS or SSH) where the device supports it.

4. Give cameras their own network

A VLAN is a separate virtual network on the same switches. Put cameras and the NVR on a camera VLAN, and let a firewall decide what may talk to what. The rules are short: cameras send video to the recorder; the recorder is reached by the viewing computers or the VPN; cameras cannot start connections to the internet or to your office computers; and nobody on the guest or tenant Wi-Fi can reach any of it. CISA's infrastructure guidance recommends segmentation because on a flat network an intruder who takes one device can move to others.

If the cameras are powered by PoE switches, remember that the switch management interface is part of the same story. Change its default login, and keep it off the camera VLAN and off tenant networks.

5. Never port-forward to a camera

Port forwarding means telling your router that traffic arriving from the internet on a certain port should go to a device inside. It is how many older installations allow remote viewing, and it exposes the device's login page to every scanner on the internet. Do not forward ports for cameras or recorders. If you need to view video from outside, use a VPN to the site, or a remote-access method that you have reviewed, with multi-factor authentication.

6. Know who can see the video

  • List who has an account on the recorder and in any app, and remove people who have left the company or the property.
  • Limit export and delete rights to a few people.
  • Set the retention period on purpose, and check that the recorder clock is correct, because time stamps matter if footage is ever needed as evidence.
  • Ask your installer or vendor what remote access they keep, and require that it is switched off or controlled by you.
  • Consider privacy: cameras inside units, restrooms or places where people expect privacy can create legal exposure. Get advice on notices and local rules.

A one-page check for a property or office

  • Inventory: every camera, the NVR, the switch, the model, the firmware, the location.
  • No default or shared credentials; passwords in a manager.
  • Firmware current or a replacement plan; the Known Exploited Vulnerabilities catalog checked for your brands.
  • P2P, cloud relay and UPnP off unless chosen on purpose.
  • Camera VLAN with deny-by-default rules.
  • No port forwarding; VPN for remote viewing.
  • Accounts reviewed twice a year.

We assess and harden camera, recorder and building-network setups as scoped, authorized work, including VLAN design, firewall rules and a clean remote-access method. We do not test systems we do not have written permission to test.

Sources

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed .

Next article

Related reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity