21,786 Home Cameras, No Password, No Warning


21,786 Home Cameras, No Password, No Warning

Pierluigi Paganini
June 12, 2026

21,786 live cameras stream with zero authentication. Cheap gear is the real risk, webcamXP open 46% of the time. Your home router is the broadcast tower.

In May 2026, Mysterium VPN queried a public internet-wide device index to count every camera and recorder that answers the open internet. They found more than three million reachable devices. Of those, 21,786 were streaming live video to anyone who pointed a browser at them, with no login, no challenge, and no warning to the person on the other side of the lens. That number is a floor, not a ceiling.

Two brands dominate the internet-reachable camera market: Hikvision and Dahua together account for most of the three million. But the headline figure isn’t about them.

Hikvision, by contrast, was open just 0.06% of the time. Dahua was effectively never open. The big brands fixed this years ago by making password setup mandatory before first use. The cheap end of the market never bothered.

“Hikvision-identified cameras were open just 0.06% of the time. Dahua was effectively never open, the direct dividend of those mandatory-activation policies. The exposure lives almost entirely at the cheap end.” reads the report published by MysteriumVPN. “Budget “HiSilicon-class” recorders were open 27.1% of the time, and a legacy webcam application called webcamXP hit 45.6%, meaning nearly half of every device of that type that answers the internet is broadcasting to anyone who asks.”

The single largest slice of open video is RTSP, the standard camera streaming protocol.

“A single generic protocol accounts for the largest share of all open video: 9,746 feeds were streaming over RTSP, the standard camera-streaming protocol, with no access control at all. RTSP was designed for streaming, not for security. Without any authentication layer, it is simply an open pipe.” continues the report.

No credentials to guess. No login screen to bypass. Just a direct feed to whoever finds the address.

Japan and the United States together account for more than a third of all open feeds, 19% and 17% respectively. That distribution doesn’t follow the global camera install base; it follows residential broadband. Japan’s count is driven by a handful of consumer ISPs whose customers appear disproportionately in the data. Moldova ranks eighth, almost entirely because of one national ISP.

A block of 961 feeds attributed to Huawei Cloud MX appears to be hosted camera-gateway infrastructure rather than home devices, inflating Mexico’s totals. Strip it out and the numbers shift slightly, but the story doesn’t change.

The networks feeding these open streams are Asahi Net, OCN, BIGLOBE, and NTT DOCOMO in Japan. Chunghwa Telecom in Taiwan. Deutsche Telekom in Germany. Verizon, Charter, and Comcast in the United States. These are home internet connections. These are living rooms, bedrooms, shop floors, and reception desks being broadcast to strangers.

None of this required any hacking. The researchers didn’t type a single password.

“We did not type a single password, default or otherwise, because doing so would be unauthorized access, the exact line this research refuses to cross.” states the report.”Every camera sitting behind a login that still answers to admin / admin is invisible in our headline figure. The true count a determined stranger could reach is larger, but we measured only what we could see without touching a key.”

The real count that a determined stranger could reach, by trying the defaults that Mirai exploited in 2016 and that Mirai’s descendants are still trying today, is larger. The 21,786 figure counts only what required zero effort at all.

The Mirai botnet in 2016 built one of the largest attack networks ever seen using nothing more than a short list of hardcoded default passwords: admin/12345 for Hikvision, admin/admin for Dahua and most budget recorders. Its descendants are still running the same credentials against the same devices right now. Regulators eventually caught up: California banned default passwords in January 2020, and the UK outlawed universal default passwords outright in April 2024 under its Product Security and Telecommunications Infrastructure Act. That fixes devices sold new today by companies that comply. It does nothing for the hundreds of millions of cameras already on walls, running firmware that will never be updated.

An open feed is not an abstract security finding. It tells a stranger when a home is empty, who lives there, and what their daily routine looks like. Feeds get aggregated, indexed, and traded. There are directories of open camera feeds that have run for years, built entirely on devices whose owners don’t know they’re listed.

“Buying cheaper gear to save money on security cameras is, in a very direct sense, paying to be surveilled. Privacy and security on your home network are worth investing in.” conlcudes the report.”A camera that phones home to a manufacturer with a functioning security team, that forces a password before first use, and that receives firmware updates is worth meaningfully more than a budget recorder that does none of those things, with the gap between them visible in our data.”

The fix isn’t complicated: set a real password, disable UPnP on your router, turn off any RTSP stream you didn’t deliberately configure, update firmware, and if the device hasn’t been patched in years, take it off the internet. Prefer cameras that reach out through an encrypted relay rather than accepting inbound connections, because there’s no open port to find from the outside. If you never set a password during initial setup, assume the device still has the factory default and change it before anything else.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cameras)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Robot mowers on a yard

Maria Diaz/ZDNET

Follow ZDNET: Add us as a preferred source on Google.


The perfect robot mower for you is not nearly as fancy and feature-heavy as you may think. I’ve said it before, and I’ll say it again: it’s not the lawn mower, it’s all about the yard. A robot mower may be a market leader with top-of-the-line specs and still not be a good fit for your yard.

Here’s the great news: There’s a perfect robot mower for almost any yard. As someone who’s tested numerous types of robot lawn mowers, I’ve learned that many of the specs that brands market as groundbreaking are simply not vital for most shoppers. A mostly flat, fenced-in 0.10-acre yard doesn’t need the power that a hilly, sectioned, unfenced one-acre yard does.

Also: I tested the Ferrari of robot mowers for a month – here’s my verdict

If you’re looking to choose the best mower for your home, be sure to check out ZDNET’s robot mower buying guide

Here’s what you don’t need to stress over when buying a robot mower

Eufy E15 Robot Mower

Maria Diaz/ZDNET
For yards with… Best robot mower type Examples
No fences A wired boundary is best, but a great GPS/RTK robot mower can stick to the map you make with it. Yardcare E400, Mammotion Luba 3
Fences A LiDAR robot mower that can be dropped to mow with little setup and learn its map as it navigates. Eufy E15, Ecovacs Goat A3000
A lot of trees A LiDAR or wired boundary mower, since trees can interfere with satellite signals. Husqvarna iQ series (optional wire, EPOS)
Unbordered garden beds A GPS/RTK robot mower that you can set up to avoid flower beds when mapping. Mammotion Luba 3, Husqvarna iQ Series
Bordered garden beds A LiDAR, GPS, or wired boundary robot mower works for these yards. If you choose a wired boundary, you may have to bury wire around the flower beds, unless the borders are tall enough for the mower to avoid. Mammotion Yuka, Navimow Series H
pets A LiDAR robot mower that can adjust its navigation in real-time in reaction to its surroundings. Mova LiDAX Ultra 2000, Segway Navimow i2
Hills and uneven terrain An AWD robot mower capable of handling steep slopes, regardless of the navigation type. Mammotion Luba 3, , Husqvarna iQ

1. Don’t focus on: ‘AI-powered’ or other marketing buzzwords

Segway Navimow X3 Series robot mower

Maria Diaz/ZDNET

Artificial intelligence (AI) has surpassed the popularity of acid-wash jeans in the 80s and Baby G watches in the early 2000s. And tech companies — including robot lawn mower manufacturers — are capitalizing on its appeal.

Most of these “AI-powered” or “intelligent mowing” terms are vague, geared to grab shoppers’ attention with buzzwords. That doesn’t mean that the robots don’t use AI to navigate, however. 

The key is to find out how the robot uses AI to its benefit, and whether that will meet your AI expectations. 

Also: This robot mower took care of my lawn for months – and it’s currently $300 off

AI algorithms typically process data captured by the robot’s hardware to help it make quick decisions and adjustments. For example, a robot lawn mower may have a set of sensors and cameras to capture its surroundings. The robot’s processor then uses AI to convert that information into actionable data, so it knows whether to swerve to avoid an obstacle or slow down around a retaining wall.

Instead, look for: The navigation tech under (and on) the hood

Instead of AI and other buzzwords, you should focus on matching the robot lawn mower’s hardware and navigation system to your yard. This includes whether the robot uses RTK (Real-Time Kinematic) for positioning, and whether it features LiDAR, cameras, and sensors. 

Then look at real user reviews to assess how accurately the robot mower maps and how well it performs around various types of obstacles.

There’s no blanket rule for robot mowers, but most do well with the following guidelines.

2. Don’t focus on: Premium extras

Yardcare E400 robot lawn mower

Maria Diaz/ZDNET

Skip the premium extras that don’t match your yard. You really don’t need the most advanced robot mower; you need the one that will best handle your lawn. 

Most US homeowners have mostly flat lawns, simple rectangular layouts, minimal obstacles, and small yards. Yet some of the most popular mowers advertise features that don’t match this, and you don’t want to spend an extra few hundred dollars on advanced features that won’t deliver a noticeable difference in your yard.

Instead, look for: Only as much as you need

Do you have a mostly flat lawn with no fences and need a robot that can navigate to several sections separated by paths? Then you can skip AWD models and commit to superior mapping and navigation features, like multi-zone intelligence.

Also: I let a modular yard care robot mow my lawn – here’s my verdict after a month

Similarly, if you have a yard with dense trees covering most of it, it’s safe to skip the RTK models and go for LiDAR or boundary wire options instead. 

3. Don’t focus on: Flashy app features

Mammotion Luba 2 robot mower path

The path lines created by the Mammotion Luba 2, as captured by our Bink Outdoor camera, is one flashy app feature I can’t quit.

Maria Diaz/ZDNET

Any dependable robot lawn mower requires an equally reliable mobile app to let you use it effectively. However, manufacturers market many flashy app features that end up being unnecessary for many users. 

Don’t make app features the deciding factor unless it’s something you genuinely care about. Many users don’t rely on voice control to run their mowers and don’t mind using a separate app for their robot rather than integrating it into an existing home automation system.

Also: I let a smart planter maintain itself for 2 months – here’s the result

A robot lawn mower with mediocre navigation and cutting performance can still have a flashy app — all while leaving behind missed patches or taking longer to finish mowing.

Instead, look for: The features you’ll actually use

Most robot mower users keep them running on a schedule to get the lawn-cutting chore off their minds. The majority of the most popular models offer basic features beyond scheduling, such as remote start and stop, basic mapping, automatic rain delay, and theft protection. 

It’s easy to find robot lawn mowers with these features, but if you’re looking for anything beyond that, just be sure that the feature is worth it, especially if you’re paying extra for that model.

Also: I’ve tested robot mowers for years – here’s my expert advice for every yard type

An example of a flashy app feature that is completely unnecessary, but I love having? The Mammotion’s pattern cutting. I can select the cutting pattern I want on the Mammotion app, whether I want lines or checkered, but I can also have the robot cut in custom patterns, like letters and numbers. I don’t care for mowed letters in my yard, but I like that it always has that freshly mowed checkered patterned with no effort from me. 

4. Don’t focus on: Cutting system extras

Segway Navimow X3 Series robot mower

Maria Diaz/ZDNET

The cutting width and system specs are important, as they can determine whether a robot can cover a given area in a day. However, most robot mowers use similar multiple-blade mulching systems. 

Unlike traditional lawn mowers with large blades for aggressive cutting in a single pass, robot mowers typically feature a set of small blades that constantly spin. Because of this, robot mowers trim smaller amounts of grass with each pass than a traditional mower, but they also cut more frequently and leave behind smaller grass clippings that decompose naturally.

Also: I powered my 3,000-sq-ft home with an EcoFlow battery in a blackout – here’s how it kept my AC on

Because the robot mowers have a smaller, compounding cutting system, the real-world differences between the cutting systems from one brand to another are often smaller than you’d expect. Other issues, like poor navigation, will be glaringly obvious before small differences in blade design.

Instead, look for: Cutting width and yard size

The average US yard would benefit more from navigation quality, consistency, and connectivity than blade design. Instead, you should focus on matching the mower to your yard size.

The robot’s capacity is measured in how many acres it can cover in a day. Among other features, this is calculated based on your robot’s battery size and cutting width. Essentially, most users want a robot that can mow an entire yard in a day, so you can set it and forget it and always come home to a mowed yard. You get this by getting the appropriate robot for your yard size.





Source link