Three CISA camera advisories this year share one line

What the month tells you to do

October is Cybersecurity Awareness Month. CISA's 2026 theme is "Securing the Next 250." The National Cybersecurity Alliance's is "Don't Make It Easy for Them," and its list of basics includes one line: "Update your software."

That advice assumes an update exists. In three CISA advisories on IP cameras this year, none lists one.

Three advisories

April 23, ICSA-26-113-05. Firmware that, in CISA's words, "fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access." The score is 9.8 out of 10 on CVSS v3.1, reachable over the network with no privileges. CISA says the vendor "has not responded to requests to work with CISA to mitigate this vulnerability."

June 25, ICSA-26-176-05. A different model with an OS command injection and an unrestricted file upload, 7.2 on v3.1 and 8.6 on v4.0. Both need an authenticated user. The vendor "did not respond to CISA's request to coordinate."

September 8, ICSA-26-251-01. A third model with a hard-coded credential for bootloader authentication, scored 6.8 on v3.1 and 7.0 on v4.0. It takes physical access, and CISA says it is "not exploitable remotely." The vendor "has not responded to CISA's attempts for coordination."

What they share, and what they do not

The flaws differ. One can be used by anyone on the network, one needs a login, one needs a hand on the device. In all three, CISA says it has no report of public exploitation targeting the vulnerability.

What repeats is the status. Each lists the product as known affected, gives no fixed version, and records that the vendor did not answer. Each also carries CISA's standard guidance: "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet."

Three is a sample, not a survey. We did not count how many camera advisories CISA publishes or how many get a vendor response, so this says nothing about how common the silence is.

Where an analytics layer fits

A layer that analyses video from cameras a site already owns inherits those cameras. We cannot patch a camera's firmware, and DHI does not scan for flaws like these. It would not have fixed any of the three.

What it can avoid is adding a second path. DHI's node reads the stream on the site's own network and the analysis runs there. Raw video stays on the premises by default, and what leaves is structured events and policy-approved clips. Whether a given camera can be reached from outside is a decision on the site's side of the network, and CISA's advice on it is plain.

For a safety or facilities manager, the useful document is a boring one: each camera model and firmware version in use, and a note on whether that vendor has ever answered a security report.

Does your camera list have that last column?

Sources

• CISA ICS advisories ICSA-26-113-05 (April 23, 2026), ICSA-26-176-05 (June 25, 2026) and ICSA-26-251-01 (September 8, 2026), read on cisa.gov
• National Cybersecurity Alliance, Cybersecurity Awareness Month 2026: staysafeonline.org
• CISA, Cybersecurity Awareness Month toolkit: cisa.gov