Wireless video surveillance cameras produced by the Chinese state-owned camera manufacturer Hikvision are reportedly being actively exploited by financially motivated and state sponsored threat actors alike, utilizing a critical vulnerability first identified in 2021. A recently published report by the cybersecurity firm CYFIRMA shows that researchers have observed a major uptick on multiple Russian-speaking dark web forums where threat actors are collaborating to exploit the vulnerability, as well as selling network entrance points and the leaked credentials of vulnerable Hikvision cameras. The flaw, tracked as CVE-2021-36260, is caused by insufficient input validation and could be exploited by attackers to launch a command injection attack by sending messages with malicious commands. Hikvision patched the vulnerability in September 2021, however, two (2) unpatched working proof-of-concept (PoC) exploits have since been published. Hikvision devices are very popular and are utilized by at least 2,300 organizations spanning across one hundred (100) countries, totaling more than 80,000 vulnerable devices. This flaw was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploitable Vulnerabilities Catalog in January 2022. The massive scale of potential targets, coupled with the low complexity to exploit due to multiple PoC’s, earns this flaw a CVSS score of 9.8. According to multiple researchers, Hikvision cameras have a poor security posture by-default, and their products are known to utilize default credentials and be easy to exploit. Researchers are unsure as to why the organization has not patched their products against the new exploits, but it should be noted that in 2021 Hikvision resigned from the largest international trade organization for surveillance vendors, known as the Security Industry Association (SIA), after being accused by the international community of collaborating research with the Chinese Army to improve military missiles. The growing popularity of network cameras, and IoT devices have made cameras like these very attractive to threat actors as a vector to drop downloaders and execute botnets to conduct denial-of-service (DoS) attacks. CTIX analysts recommend that any organizations utilizing Hikvision wireless cameras update to the latest patch, as well as change the default credentials to reflect a strong password and isolate the wireless camera network behind a firewall.