Topic
The practice of securing connected devices like cameras, routers, and sensors against firmware flaws, weak authentication, and network-based exploitation.
CISA says Viidure's dashcam platform keeps user records, live footage and firmware in a cloud bucket that anyone on the internet can read. Viidure did not answer CISA and plans no fix, so the advisory can only point users to the vendor's support page.
Reality
CISA lists 37 VIVOTEK camera models open to CVE-2026-22755, a command injection bug that can give attackers remote command execution, potentially as root. Exploit code was public before the advisory, so the first job for owners is finding out which of their cameras are on the list.
Reality
An attacker already on the camera's network can replay traffic into an administrative session on an unpatched Tapo C200 and reach its live video. TP-Link's fix shipped in August.
Reality
Prosecutors say a Nanjing contractor rented IoT botnets and commercial proxies to the MSS and PLA from 2018. No individuals were charged, and the conscripted hardware stays conscripted.
Reality
Pen Test Partners says the battery maker declined to fix exposed older installs and did not act when the UK regulator asked. On 9 April 2026 it entered administration.
Reality
The NBU says NERO R-ONE cameras bought under a 30-million-euro EU-funded project are rebadged Russian hardware carrying an SMS-triggered backdoor. The contract was the vulnerability.
Reality