13,481 CCTV recorders with known flaws exposed online, 31% in South Korea

Mysterium VPN has counted 13,481 CCTV recorders that are reachable from the open internet and running firmware with publicly known flaws, spread across at least 39 countries. The research, published on 9 November 2026, places 31% of them in South Korea alone and finds that nine of the ten networks hosting the most devices are consumer broadband telecoms.

The same passive sweep found 1,207 QNAP storage boxes running firmware affected by a critical 2024 login flaw, 8,078 smart-home message brokers that accept any connection without a password, and 3,192 Windows Remote Desktop servers with Network Level Authentication switched off. No device was contacted. The researchers worked from the aggregate counts of an IoT search engine, and 58% of the recorders had been visible in it for more than six months. The full dataset and method are in Mysterium VPN’s research on vulnerable CCTV recorders, which follows the company’s June 2026 study of 21,786 camera feeds viewable with no login at all.

Which flaws are the exposed recorders running?

Two firmware families account for every recorder in the count, and both flaws have been public for years. The larger group, 12,655 devices, runs firmware built for HiSilicon-based hardware that contains a local file inclusion flaw, the class of bug that lets an attacker read arbitrary files from a device and, often, go on to run code on it. Problems in this firmware family were widely documented in 2020, including a hidden remote-access mechanism; the study notes that Huawei, whose HiSilicon unit designs the chips, attributed that mechanism to the device manufacturers rather than to its own software.

The smaller group, 826 recorders, is vulnerable to CVE-2018-9995, a flaw in TBK digital video recorders and the many brands that resell the same hardware. A single crafted request makes an affected device hand back its user accounts and passwords. The flaw was published in April 2018 and working exploit code followed within weeks, so these are devices that have been trivially takeable for more than eight years. The scanning engine’s check confirmed all 826 as affected.

The reason the problem persists is economic rather than technical. Budget recorders are built on a handful of chip platforms with white-label firmware, then sold under hundreds of brand names. A flaw in the shared firmware lands in all of them at once, and most of those brands never ship a fix. Few of these devices were put online deliberately, either: an installer forwards a port so the owner can check the feed from a phone, or UPnP lets the box open its own port without asking, and once the picture appears on the app nobody logs into the recorder again.

An exposed recorder is a privacy failure first, since it carries live and recorded video of whatever it points at. It is also a foothold. The box sits inside a home or small-business network alongside laptops and phones, and recorders of exactly this type have been conscripted into botnets since Mirai in 2016.

Where are the vulnerable recorders?

Asia holds 54% of the vulnerable recorders (7,339) and Europe 32% (4,257), with South America at 1,002, North America at 589, Africa at 237 and Oceania at 57. One country dominates. South Korea has 4,169 vulnerable recorders, 31% of the world total, more than Russia (1,899), Türkiye (714) and Brazil (583) combined. Taiwan (578), Iran (531) and Vietnam (411) follow, and the United States, with 361, is only eighth. Inside the European Union, Italy (303) and Poland (301) have the largest counts, while Bulgaria and Romania are the most exposed relative to their population.

Adjusted for population, the gap is starker. Among countries with at least 100 vulnerable recorders, South Korea has 80.7 per million people, followed by Bulgaria (40.9), Romania (14.9) and Russia (13.2). The United States sits at 1.1 per million, Japan at 1.2 and Mexico at 0.9, which by the study’s reckoning makes South Korea’s rate about 76 times the American one. China, where most of the chips inside these devices are designed, shows just 49 devices, or 0.03 per million; the researchers say they cannot tell whether that reflects fewer vulnerable devices or simply less of China’s address space being visible to outside scanners.

The network data explains the geography. A recorder is a physical box on someone’s premises, so its IP address belongs to whoever supplies that building’s connection, and the busiest networks in the dataset are simply the largest domestic ISPs: Korea Telecom (2,426 devices, 18% of the global total), SK Broadband (759), Turk Telekom (546), LG U+ (480), Chunghwa Telecom (417), Rostelecom (390) and Iran Telecom (332). Nine of the ten busiest networks are telecoms, and between them they carry 43% of every vulnerable recorder counted.

What else did the sweep find?

Recorders were the headline, but the study logged five further exposure classes over the same 30-day window, and several of them matter more to ransomware defenders than the cameras do.

Exposure	Devices	Leading countries	Visible for 6+ months
CCTV recorders with known firmware flaws	13,481	South Korea 4,169, Russia 1,899, Türkiye 714	58%
QNAP NAS affected by CVE-2024-21899	1,207	China 148, Taiwan 140, Italy 125	65%
MQTT brokers with no authentication	8,078	United States 1,489, South Korea 1,302, Germany 669	80%
Windows or Samba file shares open to guests	50,556	United States 6,852, France 3,614, Russia 3,197	not stated
Windows Remote Desktop without NLA	3,192	United States 849, France 561, Germany 479	94%
VNC and noVNC desktops with no password	562 and 611	noVNC clustered on Hetzner, DigitalOcean and OVHcloud	not stated
Android Debug Bridge open	251	more than half on cloud servers	not stated

The 1,207 QNAP devices run firmware affected by CVE-2024-21899, an improper-authentication flaw rated CVSS 9.8 that QNAP patched in March 2024. More than two years after the fix, 65% of these boxes have been visible for more than six months. QNAP units have been a ransomware target in their own right: the DeadBolt campaign locked thousands of them in 2022 and replaced the login page with a ransom note. Mysterium found no NAS still displaying that note in the current window, so the present exposure is an unpatched front door rather than an active campaign.

The MQTT figure is the one the researchers trimmed hardest. MQTT is the message bus that smart plugs, thermostats, alarm panels and industrial sensors use to talk to a hub, and anyone who can connect to an open broker can usually read every message and often issue commands. The raw count was 42,919 brokers with no authentication, but 34,841 of them were new addresses at a single cloud provider, spread across its regions and all first seen in the same month. That pattern looks like research honeypots rather than smart homes, so the study excluded them and reports 8,078, with 80% exposed for more than six months.

The 3,192 Remote Desktop servers without Network Level Authentication are the most Western category in the dataset, with 64% in Europe and 29% in North America, and 94% exposed for more than six months. Most are rented servers, which is precisely the population that gets brute-forced, sold on through the initial access broker market and encrypted.

How was the research done?

The count is entirely passive, and the study is careful about what that means. Mysterium queried a commercial IoT search engine, which it does not name, that continuously scans public IP space and runs checks for specific published flaws against the devices that answer. The team counted records the engine had last seen between 30 September and 30 October 2026, where one record is one address and port failing one check, and kept only the totals and the engine’s own breakdowns by country, continent and network operator. No device was scanned, connected to or logged into, and no IP address or hostname was stored. That is the right side of the line between measuring exposure and exploiting it, and it is the same discipline the company applied in its earlier census of exposed AI endpoints.

To test the scale, the researchers ran four of the exposure types through a second IoT search engine on 3 November 2026. The second engine saw far more: 209,856 open message brokers (26 times the first engine’s count), 6,477 VNC desktops with authentication disabled (12 times), 4,362 open Android debug ports (17 times) and 155,013 file services answering without authentication (3 times). The rankings agreed even where the totals did not. South Korea is first or second for open brokers in both engines, and the United States leads both for passwordless VNC. Two concentrations stand out in the second dataset: 141,963 open brokers, 68% of the world total, on SK Broadband, and 84,109 open file services, 54%, on a single Pakistani telecom. Blocks that size look like one product deployed at scale with a port left open, not thousands of individual mistakes. The second engine has no check for the two recorder flaws, so there is no independent count for the cameras themselves.

The limitations are the usual ones for this kind of work, and the authors list them. Home connections change address, so a device that moved during the month can be counted twice; the engine does not see every address, which pulls the other way. Country rankings depend on IP geolocation. The file-share and Remote Desktop counts include business servers, which is why the study reports them separately from the home figures. For a primer on how these indexes differ from one another, see our guide to attack-surface mapping with Shodan, Censys and FOFA.

Why this matters for ransomware defenders

Three of the six exposure classes in this study are established ransomware entry points, and a fourth is a botnet recruitment pool. Exposed NAS devices have already been monetised at scale by DeadBolt and, before it, Qlocker in 2021. Remote Desktop without Network Level Authentication is the raw material of credential brute-forcing. Guest-readable SMB shares are where attackers find the backups they need to delete before encrypting. And a recorder with a years-old file-inclusion flaw is a persistent, unmonitored Linux box inside the network, ideal for staging and for the DDoS-for-hire botnets that have fed on this hardware since Mirai.

The concentration is the useful part. Because a few national ISPs carry such a large share of the devices, remediation does not have to reach 13,481 owners one at a time. Korea Telecom alone could notify the owners of 18% of the world’s vulnerable recorders. Organisations such as the Shadowserver Foundation already send network owners free daily reports of vulnerable devices in their ranges; the study’s closing recommendation is that providers pass those warnings on to the customers behind them.

What should device owners do?

• Audit the router first. Review every port-forwarding rule and remove any you did not create or no longer need. Disable UPnP unless something you rely on needs it, since UPnP is how a device opens its own port without asking.
• Never expose a recorder or NAS directly. Reach it through a VPN into the home or office network, or through the vendor’s outbound relay service, rather than an inbound port.
• Patch or retire. QNAP owners should install current firmware; the fix for CVE-2024-21899 has been available since March 2024. If a recorder’s maker no longer ships firmware, replace it with a supported model, because an unpatchable device with a known flaw does not get safer with time.
• Lock the smart-home hub. An MQTT broker should require a username and password and, ideally, listen only on the local network.
• Harden remote access. Turn on Network Level Authentication for Windows Remote Desktop, never run VNC without a password, and keep the Android Debug Bridge off any device that faces the internet.
• Segment. Put cameras, recorders and IoT hubs on their own network segment, away from the computers and phones that hold your data. If one of them is compromised, segmentation is what turns a breach into a nuisance.

For organisations, the practical check is the same one the researchers used: query your own external ranges in an IoT search engine and see what answers. If something you own appears in that index, assume someone less friendly has already found it, and work from the incident response runbook rather than from the hope that it was missed.

Frequently asked questions

Sources and further reading

• Mysterium VPN: 13,481 CCTV Recorders With Known Flaws Found in 39 Countries (research by Gintarė Mažonaitė, 9 November 2026)
• Mysterium VPN: Nearly 22,000 live cameras with no login required (research, June 2026)
• QNAP Security Advisory QSA-24-09: CVE-2024-21899, CVE-2024-21900 and CVE-2024-21901 (8 March 2024)
• NIST National Vulnerability Database: CVE-2018-9995, TBK DVR credential disclosure
• Shadowserver Foundation: free daily network reports for ISPs and network owners