The Centre for Cybersecurity Belgium issued an advisory detailing how attackers exploit compromised IP cameras for espionage, data theft and as pivots into broader networks, according to a Cybernews report published September 16. Agency data placed more than 87,000 such cameras as exploitable across Europe, with Italy recording the highest count. The assessment found that many devices run outdated software or retain factory settings, allowing unauthorised access to live feeds and stored recordings. Home users face particular risks including privacy invasions that reveal occupancy patterns for potential burglaries, the advisory noted.
OPSWAT researchers identified three flaws in the widely used TP-Link Tapo C200 cameras, two of them high-severity, a separate Cybernews article from September 15 stated. One vulnerability permits an attacker on the local network to bypass login controls and obtain administrator privileges without the owner’s password. TP-Link addressed the issues in firmware version 5.1.4.6 released in August, yet the firm indicated that devices on earlier versions stay vulnerable until updated. The cameras, often deployed for baby monitoring and home security, include night vision that could expose interiors after dark.
A McAfee analysis of webcam and home camera compromises attributes most incidents to weak or reused passwords rather than inherent device defects. The guide recommends changing factory defaults immediately upon setup to combinations of at least 12 characters mixing letters, numbers and symbols. Users should avoid recycling credentials across accounts since breaches at one service can cascade to camera systems through credential stuffing, according to Federal Trade Commission warnings cited in the material.
Two-factor authentication adds a critical layer by requiring a second verification step even after password compromise, McAfee specialists advised. The measure applies to camera applications, associated cloud accounts and router logins. Firmware and software updates must run automatically where possible because manufacturers regularly patch newly discovered vulnerabilities, a Kaspersky blog post from August 19 emphasised. Physical covers or privacy modes provide an additional safeguard when cameras sit unused.
Network segmentation further limits damage by isolating cameras on guest Wi-Fi or dedicated VLANs away from computers and sensitive data, the Belgian agency recommended in its September 14 guidance. Disabling remote access features such as UPnP and port forwarding prevents external exposure unless a VPN secures the connection. Review of access logs for unfamiliar IP addresses or login times can reveal breaches early, according to a Project OSINT cybersecurity checklist published in November 2025 that remains relevant.
Hunt.io researchers documented more than 14,000 compromised Dahua cameras in Ukraine and Russia last month as part of an operation called CameraSwarm, Cybernews reported. Those incidents demonstrated how cameras serve as persistent footholds once initially breached through default credentials or unpatched flaws. The combined advisories stress that proactive configuration rather than device replacement addresses the majority of risks when applied consistently across all connected cameras.
