There is a dangerous assumption at the heart of most physical security deployments: that because a device is a security device, it is inherently secure. The reality is the opposite. IP cameras, NVRs and access control panels are networked computing devices that run operating systems, open network ports and — in far too many deployments — still use manufacturer default passwords.
Physical security devices have become a major attack vector for cybercriminals. In 2023, a single compromised camera manufacturer's firmware was used to breach 250,000 devices globally within 72 hours of the exploit being published.
The Most Common Vulnerabilities
Default credentials: Studies consistently find that 30–40% of installed IP cameras and NVRs accessible from the internet are running default manufacturer usernames and passwords. These credentials are publicly documented and the first thing any automated scanner tries. A Mirai-variant botnet can identify and compromise a default-credential camera in under 4 seconds.
Unpatched firmware: Camera and NVR manufacturers release firmware updates that patch security vulnerabilities. Most organisations do not have a firmware update process for physical security devices — often because the devices are treated as appliances rather than networked computers. Known vulnerabilities from 2020 are still exploitable on devices running firmware that was never updated.
Open ports and direct internet exposure: Many CCTV installations are configured with port forwarding to allow remote viewing — exposing the NVR management interface directly to the internet. A web interface vulnerability, combined with a default or weak password, gives an attacker direct access to live camera feeds, stored footage and potentially the local network.
Flat network architecture: Physical security devices placed on the same network segment as corporate IT systems allow a compromised camera to be used as a pivot point for lateral movement into the corporate network — accessing file servers, databases and email systems via an IP camera is a documented attack pattern.
Hardening Your Physical Security Infrastructure
Change all default credentials immediately: Every camera, NVR, access control panel and IoT device should have a unique, strong password set during installation. This single step eliminates the majority of opportunistic attacks.
Network segmentation: Place all physical security devices on a dedicated VLAN with firewall rules that prevent lateral movement to corporate network segments. Security devices can reach the internet for firmware updates and cloud management but cannot initiate connections to corporate file servers or databases.
Firmware update schedule: Establish a quarterly firmware update review process. Subscribe to security advisories from your camera and NVR manufacturers. Critical security patches should be applied within 72 hours of release.
Use a VPN for remote access: Remove all port-forwarding rules. Remote access to camera feeds and NVR management should be through a VPN connection to a secure access gateway — never through a directly exposed NVR interface.
Disable unused services: Most IP cameras and NVRs have numerous services enabled by default — Telnet, UPnP, SNMP, CGI — that are not needed in most deployments and each represents an additional attack surface. Disable everything that is not actively used.
Physical Security of the Physical Security System
Network hardening addresses cyber attacks. Physical hardening addresses the equally important risk of physical tampering: NVRs mounted in accessible locations, cameras reachable from the ground, server room doors with inadequate access control. Pujaso's standard installation practice includes tamper-evident mounting for all cameras, NVR placement in locked enclosures, and power protection to prevent hard resets that would restore default credentials.