In brief: In 2026, home security cameras are targeted at mass scale — 14,530 cameras were compromised in a 35-day campaign (June–July 2026), and a separate May 2026 scan found over 21,000 devices streaming live video with no password whatsoever. The real fixes: a strong unique password + current firmware + disabling port forwarding and UPnP. For safe remote viewing, use a VPN tunnel into your home network instead of exposing the camera — the device stays on the LAN, invisible from outside. When watching your camera from a café or hotel, also enable LiMP VPN to encrypt the session and hide your IP from others on the same network.
Why Security Cameras Are Easy Targets in 2026
Internet scanners continuously sweep IP ranges looking for open ports. Security cameras, video doorbells, DVRs, and NVRs are especially exposed: there are millions of them, they run 24/7, and their owners rarely apply the same security discipline they would to a computer.
The scale of the threat in 2026 is backed by real data. In May 2026, researchers conducted an internet-wide scan and found more than 3 million externally reachable camera and recorder devices. Of those, 21,786 were streaming live video with no login, challenge, or warning. In June–July 2026, attackers ran a targeted campaign: 14,530 cameras were compromised in 35 days, primarily targeting Dahua devices and hardware built on their platform.
Historical context shows why the problem persists: in 2016, the Mirai botnet hijacked more than 600,000 IoT devices using just 61 default username/password combinations. A decade later, hundreds of thousands of cameras worldwide still run on factory credentials. California banned default passwords in January 2020; the UK's PSTI Act outlawed universal default passwords in April 2024 — but neither law covers devices already installed on old firmware.
How Cameras Get Hacked: Main Attack Vectors
Attacks on cameras are rarely sophisticated — they exploit predictable configuration mistakes. Here are the five main vectors, how they work, and what actually closes the risk.
| Attack Vector | How It Works | What Closes the Risk |
|---|---|---|
| Default passwords admin/admin, admin/12345 | Scanners find an exposed camera interface and try well-known pairs: Hikvision uses admin/12345, Dahua and budget DVRs use admin/admin. No special skills needed. | Immediately change to a unique, strong password; enable two-factor authentication on the cloud account. |
| Port forwarding / DDNS port 37777 and others | Port forwarding makes the camera directly reachable from the internet. In the 2026 campaign, attackers scanned specifically for port 37777 (Dahua protocol), finding thousands of exposed devices. DDNS is "solely a locator" — it makes discovery easier but adds zero encryption or access control. | Remove port forwarding rules; disable DDNS for direct access; switch to a VPN tunnel into your home network. |
| UPnP on the router | UPnP lets devices on your network silently ask the router to open an inbound port — without user involvement. A camera or DVR may open itself to the internet in the background, and you would never know. | Disable UPnP in the router settings — see the guide on secure home router settings. |
| Firmware vulnerabilities CVE-2021-33044, CVE-2021-33045, backdoor p2pwn | The CVE-2021-33044/33045 authentication-bypass exploits were actively used in the 2026 campaign: 1,923 cameras were compromised this way. The backdoor account p2pwn / p2password survived admin password changes and, on most firmware, even a factory reset. | Update camera and NVR firmware to the latest version; if the device no longer receives updates, consider replacing it. |
| Manufacturer P2P cloud serial-number relay | Dahua's cloud P2P relay allowed access to a camera using only its serial number: 283 cameras in the 2026 campaign were compromised through this mechanism — with no credentials at all. | Disable unauthorized P2P cloud relays; restrict or deactivate the manufacturer's cloud service. |
Port Forwarding, P2P Cloud, or VPN: Safe Remote Camera Access
When you want to view your camera from your phone outside the house, you have three fundamentally different options. The security difference between them is significant.
| Remote Access Method | Encryption | Exposes Camera to the Internet? | Who It's Right For |
|---|---|---|---|
| Port forwarding (DDNS) | No — only username/password | Yes, directly | Not recommended for anyone |
| Manufacturer P2P cloud | Depends on vendor — closed protocol | Partially — traffic routes through vendor servers | Acceptable if you trust the vendor; worse than your own VPN |
| Home VPN server (router or dedicated device) | Yes — entire tunnel encrypted | No — camera stays on the LAN | Recommended for everyone |
The key difference with a home VPN server: the camera never "moves" — it stays on your local network. You connect to your router or a dedicated device over an encrypted tunnel (WireGuard or OpenVPN/IKEv2) and access the camera from inside your own network. From the outside, only encrypted traffic on a single VPN port is visible — not an open RTSP stream or the camera's web interface on port 37777.
It is important to distinguish this from a consumer VPN app: a home VPN server is a server inside your network that your phone connects to. How to set one up is covered in how to protect your home network with a VPN. The P2P cloud is more convenient, but you hand your camera traffic to a third party — the manufacturer's cloud — running a closed protocol you cannot inspect.
Where LiMP VPN Fits: Protecting the Viewing Session
Honesty matters here: LiMP VPN does not protect the camera device from being hacked, and it does not replace a home VPN server. These are different tools for different jobs.
LiMP VPN's role is on the other end. When you open the camera app from a café, hotel, or airport, you are connecting over public Wi-Fi. Others on that network can attempt to intercept unencrypted traffic — login credentials, the RTSP video stream, requests to the manufacturer's cloud. LiMP VPN encrypts all traffic from your device and hides your IP address, preventing others on the same network — or your ISP — from seeing which systems you are connecting to.
In short: a home VPN tunnel secures the camera on the "server side"; LiMP VPN protects you on the "client side" — on your phone or laptop when you are on an untrusted network. Both layers together give you complete session protection.
How to Set Up Secure Remote Access to Your Camera
The order of steps matters: do not set up remote access before closing the basic vulnerabilities. The sequence below moves from eliminating vulnerabilities to enabling secure access.
- Change the default password. Set a unique, strong administrator password for the camera and DVR/NVR — not admin/admin or admin/12345. Use a password manager so you do not forget it or reuse it on other devices.
- Disable port forwarding and UPnP on the router. Open the router settings and remove all forwarding rules for the camera and DVR. Deactivate UPnP — it may have opened ports in the background without your knowledge. Disable DDNS if it is configured for direct camera access.
- Update camera and NVR firmware. Check for updates in the device interface or on the manufacturer's site. The 2026 campaign exploited CVE-2021-33044/33045 — patches for those have existed for years; they just were not installed.
- Set up a VPN server on your home router or a dedicated device. Many modern routers support WireGuard or OpenVPN natively. This lets you connect to your home network over an encrypted tunnel — the camera stays on the LAN and is not exposed to the internet.
- For remote viewing, connect to the home VPN first. Only then open the camera — it will appear as a local resource. From an untrusted network (café, hotel, airport), also enable LiMP VPN to encrypt the session and hide your IP.
- Enable two-factor authentication on the cloud account. If you use the manufacturer's cloud service (Hik-Connect, Dahua DMSS, etc.), turn on 2FA. Check the login log regularly: unfamiliar IPs or unusual times are a reason to change the password.
Checklist: What to Do Right Now
- Change the camera and DVR/NVR password to something unique and strong (not admin/admin or admin/12345).
- Enable two-factor authentication on the camera's cloud account.
- Update the camera and recorder firmware to the latest version.
- Disable UPnP in the router settings.
- Remove port forwarding rules for the camera and DVR; disable DDNS for direct access.
- Set up VPN access into your home network (instead of exposing the camera directly).
- Move cameras to a separate guest network or VLAN — see smart home privacy and data protection for the broader IoT isolation strategy.
- Review the cloud account login log: unfamiliar IPs or unusual hours are a warning sign.
Signs Your Camera Has Already Been Compromised
A hacked camera does not always announce itself: the device keeps recording, the image looks normal, and no alerts appear. That is why it is important to know the indirect signals that are easy to miss without deliberate attention.
Watch for the following — especially if they appear without any changes you made:
- The activity LED is on or blinking when nobody is supposed to be viewing the camera.
- A PTZ camera moves on its own — panning or tilting without your command.
- The cloud account or camera log shows unfamiliar IP addresses or unusual access times.
- A sharp spike in outbound traffic on the router with no obvious explanation — the camera may be continuously streaming footage externally.
- Settings you did not change: a new admin account, 2FA disabled, RTSP password changed.
- Voice or noise from the camera speaker (if it has two-way audio) without your involvement.
Frequently Asked Questions
Can someone watch my camera without a password?
Yes, if the camera is exposed to the internet with factory or weak credentials: automated scanners find open devices within minutes. The May 2026 scan found more than 21,000 cameras streaming video with no login at all. A unique password and closed external access eliminate this scenario.
Will a VPN save my camera if it has already been hacked?
No. First eliminate the compromise: change the password, update the firmware, and if possible perform a factory reset followed by a reflash — some backdoors (such as p2pwn from the 2026 campaign) survive even a factory reset. Only after the device is clean should you configure secure access.
Why is a manufacturer's P2P cloud worse than my own VPN tunnel?
P2P cloud is convenient, but traffic passes through the vendor's servers over a closed protocol — you are trusting your camera feed to a third party, with no visibility into how the channel is actually encrypted. A home VPN tunnel keeps access entirely under your control: traffic never touches the manufacturer's servers.
Should I put cameras on a separate network?
Strongly recommended. A guest network or VLAN isolates cameras from computers, phones, and smart devices: if a camera is compromised, the attacker does not gain access to the rest of the network. This is the same principle behind keeping IoT devices on a separate segment.
Are video doorbells and Wi-Fi cameras secure out of the box?
Usually not. Most ship with identical credentials for the whole product line, and firmware updates are infrequent or not applied automatically. Change the password immediately after connecting and check for updates — California (2020) and the UK PSTI Act (2024) banned universal default passwords, but that does not help devices already installed on old firmware.
How do I check whether my camera is reachable from the internet?
Check your router settings: are there port forwarding rules for the camera's or DVR's IP address? Is UPnP active? Is DDNS configured for direct access? If any of these are present, remove them and switch to a VPN tunnel into your home network.
What is port 37777 and why do attackers scan it?
Port 37777 is the standard port for the Dahua protocol used by cameras and DVRs from that manufacturer. It is widely known in the security research community: scanning the internet for open port 37777 quickly yields a list of thousands of devices with their IP addresses. This is precisely the port attackers scanned in the June–July 2026 campaign.