Camera Firmware Patch Management: The Reliability Question Vendors Don't Want You Asking

On 5 March 2026, CISA added CVE-2017-7921 to its Known Exploited Vulnerabilities catalog. It is an improper authentication flaw in multiple Hikvision IP camera series that lets an unauthenticated attacker bypass login entirely, escalate privileges and reach sensitive information, and it has been publicly known since 2017 (CISA, Known Exploited Vulnerabilities Catalog, cisa.gov/known-exploited-vulnerabilities-catalog, entry added 2026-03-05, retrieved 2026-08-04).

Nine years between disclosure and a federal catalog listing. Federal civilian agencies then had until 26 March 2026 to patch it or stop using the product, under Binding Operational Directive 22-01. That deadline has passed.

Buyers evaluating camera vendors almost never ask about patch cadence or disclosure history. They ask about resolution, field of view and price. The KEV catalog is where that gap shows up.

Why Patch Cadence Matters More Than the Spec Sheet

A camera's resolution and low-light performance are fixed the day it ships. Its exposure to attack isn't.

A vulnerability discovered two years after a camera is installed is only a risk to the buyer if the vendor is slow to disclose it, slow to patch it, or reluctant to file it publicly at all. None of that appears on a spec sheet, and none of it can be evaluated by comparing megapixels. It's the same evaluation problem we've written about in camera supply chains: the risk sits in the vendor's process, not in the hardware you can hold.

The asymmetry in the timeline above is the thing to hold onto. Nine years for the flaw to reach the catalog. Twenty-one days for agencies to fix it once it did, counting from the 5 March listing to the 26 March deadline. That's the window a buyer inherits, and it opens with no warning.

The Lag Is Longer Than the Catalog Date Suggests

The KEV listing date isn't when exploitation started. It's when the federal government finished confirming it.

For CVE-2017-7921, the SANS Internet Storm Center had reported detecting exploit attempts against susceptible Hikvision cameras more than four months before the catalog entry appeared.

Earlier still, the FBI issued a Private Industry Notification stating that in March 2024, HiatusRAT operators ran a scanning campaign against web cameras and DVRs in the US, Australia, Canada, New Zealand and the United Kingdom, specifically scanning for this vulnerability among others, using an open-source webcam scanner and a brute-force tool against Hikvision devices with telnet exposed (FBI Private Industry Notification, ic3.gov, 16 December 2024, retrieved 2026-08-04).

The FBI notice carries a line worth reading twice. As of December 2024, it stated, Hikvision had not mitigated CVE-2017-7921 across all impacted devices, having released updates only for cameras sold through authorized distributors. That is a federal agency saying, more than seven years after disclosure, that a fix hadn't reached the whole installed base.

Public scanning tooling for this specific flaw exists as well, including a template in the widely used ProjectDiscovery Nuclei repository, and vulnerability-intelligence services tag the flaw as easy to weaponize, unauthenticated and vulnerable in default configuration (AttackerKB, attackerkb.com, retrieved 2026-08-04).

So the honest sequence for a device on a customer's wall runs: disclosed 2017, tooling published, scanned by a named threat campaign in 2024, exploit attempts observed by a research organization in late 2025, catalog listing March 2026, patch deadline three weeks later. A buyer sitting anywhere in that timeline had a working camera and no signal that anything was wrong.

This Is a Pattern, Not One Vendor Having One Bad Week

It's easy to treat camera security as a story about a single breach and move on once the headline fades.

The affected firmware in this case spans builds from 2014 through 2016 across seven Hikvision device series, which is to say the exposure isn't a narrow product recall. It's a population of installed devices, many of them still mounted, still recording, still reachable. Hikvision is also a covered vendor under Section 889 of the NDAA, so for federal, state and municipal buyers the procurement question and the patching question arrive together.

The underlying question, how a vendor handles disclosure and patching over time, is therefore a standing evaluation criterion rather than a news cycle to check off. A camera isn't a phone. Nobody replaces it every three years, and the deployment lifetime is exactly the window in which this risk accumulates.

What a Mature Disclosure Program Looks Like

Not every vendor handles this the same way, and the differences are visible from outside without any special access.

A buyer should expect three things.

CVE Numbering Authority status, or a clear reason it's absent. A vendor registered as a CNA can assign and publish CVE identifiers for its own products directly rather than waiting on a third party. That shortens the path between finding a flaw and telling customers about it.

Advisories that name versions. A useful advisory states the specific affected firmware builds and the specific release that fixes them. An advisory that says a security issue has been addressed in the latest firmware tells a fleet operator nothing actionable.

A funded route for outside researchers. A bug bounty or coordinated disclosure program means flaws have somewhere to go other than a forum or a marketplace.

Red Flags: A Low CVE Count Is Not a Clean Record

The counterintuitive part of evaluating this is that CVE counts run backwards from what buyers assume.

A published, promptly disclosed vulnerability is evidence that a security program exists and is working. A vendor with no CVEs has either built something unusually clean or hasn't been examined closely, and a buyer can't tell which from the outside. Under-reporting produces the same number as excellence.

The same logic applies to marketing that cites a low public CVE count as a security credential. That number measures disclosure behavior at least as much as it measures product quality, and it isn't a metric a buyer should accept without asking how the vendor decides when to file.

Where to Check a Vendor's Record Directly

Buyers don't have to take a vendor's word for any of this. Three sources are public and searchable by vendor name.

CISA's Known Exploited Vulnerabilities catalog shows what a federal agency has confirmed is being exploited in the wild, with a remediation deadline attached. The National Vulnerability Database shows the fuller CVE record with severity scoring. Independent surveillance-industry research, including outlets that specialize in this market, covers disclosure practices that neither database captures.

A vendor with a clean, well-documented history across those sources is telling a different story than one with years-old CVEs surfacing on the KEV catalog and no visible advisory trail behind them.

Iron Gate's Position

Our position is that a disclosure record is a purchasing criterion and should be treated like one, including when the record is ours.

We treat published, promptly disclosed vulnerabilities as a sign of a functioning security program rather than a mark against a product, and we think a buyer should check our patch and disclosure record the same way we're asking them to check anyone else's: against CISA KEV, the National Vulnerability Database and independent reporting, rather than against marketing copy.

The second thing we'd say is about what happens after purchase. The nine-year gap above wasn't only a vendor failure. It was also a fleet-management failure at thousands of sites, because a patch that exists and is never applied protects nobody. Ask how firmware updates reach deployed units, whether that is automatic or manual, and who is accountable for it on an installed base of a hundred cameras across a dozen buildings. That's the same fleet-management question that decides real-world camera failure rates, and it decides whether a twenty-one day remediation window is achievable or theoretical.

Every internet-connected device with firmware and years of field life ahead of it will eventually have a flaw found in it. What a buyer can evaluate in advance is whether there's a real process for the day that happens.

Common Questions

How often do security camera vendors release firmware patches?

There's no industry-standard cadence, which is the problem. Some vendors publish dated advisories naming affected and fixed versions as issues are found. Others have gone years between a vulnerability's original disclosure and any visible remediation record appearing in public databases.

Which camera vulnerabilities has the federal government confirmed as actively exploited?

CVE-2017-7921, affecting multiple Hikvision IP camera series, was added to CISA's Known Exploited Vulnerabilities catalog on 5 March 2026 with a federal remediation deadline of 26 March 2026 under Binding Operational Directive 22-01 (cisa.gov, retrieved 2026-08-04). KEV entries are documented federal determinations of real-world exploitation, not allegations.

Does a vendor with few published CVEs make a more secure camera?

Not necessarily, and the assumption is a common trap. A low count can mean a clean product or an under-reporting policy, and the two are indistinguishable from outside. What distinguishes them is whether the vendor publishes versioned advisories, holds CVE Numbering Authority status, and gives outside researchers a route to report.

How should a buyer evaluate patch management before purchasing?

Ask whether the vendor is a CVE Numbering Authority, ask for its advisory publication history, ask its stated interval between a report and a released patch, and check CISA KEV and the National Vulnerability Database for that vendor's name before signing. Then ask the operational question: how does a released patch actually reach the cameras already on the wall?

What should an operator do about cameras already installed?

Inventory what's deployed, including model and firmware build, because remediation deadlines are measured in days and an unknown fleet can't meet one. The affected builds in the Hikvision case ran from 2014 to 2016 across seven device series, which is the kind of detail that only helps an operator who already knows what they own.

Where to Start

Pull the model and firmware version for every camera on the network, then search those vendor names against the CISA catalog. That single exercise tells an operator more about their exposure than any spec sheet comparison.

To ask about our firmware update process and disclosure practices, or to review what's currently deployed at your sites, call Iron Gate Technologies at 904-896-5618 or book a security assessment.

Sources

• CISA, Known Exploited Vulnerabilities Catalog, entry for CVE-2017-7921 added 5 March 2026 (cisa.gov).
• CISA alert, five vulnerabilities added to the catalog, 5 March 2026.
• Binding Operational Directive 22-01.
• FBI Private Industry Notification, HiatusRAT actors targeting web cameras and DVRs, 16 December 2024 (ic3.gov).
• AttackerKB entry for CVE-2017-7921 (attackerkb.com).
• National Vulnerability Database entry for CVE-2017-7921 (nvd.nist.gov).
• All retrieved 2026-08-04.

Iron Gate Technologies