Camera CVE tracker

A published CVE means a vulnerability was documented. A KEV Yes means CISA has evidence it has been used. Most camera CVEs never make the KEV catalog. The ones that do are the doors that already opened somewhere, which is why patch latency on those rows is a fleet problem rather than a research problem. How those doors get walked, and what closes them, is in IP camera vulnerabilities.

Axis, Bosch, and Hanwha publish camera CVEs on their own advisory pages, and those rows are in this table. CISA currently lists none of them as exploited in the wild. That is a statement about KEV, not a claim those products have no vulnerabilities.

Methodology

Two feeds, rebuilt on a monthly cadence, free to cite. The first is CISA's public KEV JSON, the same catalog CISA publishes for BOD 22-01: vulnerabilities with evidence of exploitation in the wild. This page keeps the camera-shaped slice of that catalog. The second is vendor PSIRT: Axis security advisories, Bosch PSIRT camera and CPP-titled advisories, and Hanwha Vision S-CERT vulnerability reports for cameras, NVRs, and DVRs. A CVE that appears in both feeds is one row, marked Yes for in the wild.

The KEV slice keeps a row when the vendor is a camera or recorder manufacturer (Hikvision, Dahua, Amcrest, Reolink, NUUO, PTZOptics, GeoVision, Digiever, TVT), or when the product field is camera-shaped for vendors that also ship other gear (Edimax IP cameras, QNAP VioStor NVR, D-Link DCS and DNR). Those names dominate the in-the-wild column because that catalog is the slice where CISA has evidence of exploitation. Hikvision and Dahua stay KEV-only here. This page does not scrape NVD for those brands. The slice also keeps intercoms, door stations, and network speakers when a feed lists them. Rows for fire alarm, access control, media servers, camera-upload features on non-camera products, UniFi, PBX, NAS, and the rest of a vendor's IT catalog are dropped. Axis Camera Station, AXIS Device Manager, Bosch Rexroth, Bosch MAP, and Hanwha VMS or statement PDFs are out of scope. Axis IDs still under embargo, listed without a published summary, are excluded until Axis publishes the advisory text.

Two caveats matter for interpretation. First, KEV is not a complete history of camera exploitation. CISA adds rows as evidence meets its bar, sometimes years after disclosure. Second, a listing is not a finding that a given fleet is vulnerable. The product string can be as broad as "Multiple Products" or "AXIS OS." A model search (M3005-V) maps the model to a vendor and shows that vendor's camera CVEs; it does not mean every listed CVE affects that camera. Confirm against inventory, firmware, and the vendor advisory linked from NVD. If a vendor scrape fails at refresh time, the last successful pull for that vendor is kept rather than emptying the table.

Journalists, researchers, and operators are welcome to cite and republish these figures with a link back to this page so readers can check the method and the current feeds. If a row looks wrong, write [email protected] with a source.

Questions about this tracker

What does this list include?

Published camera, NVR, and DVR CVEs from vendor advisories and from CISA KEV. Each row is flagged Yes or No for whether CISA has listed that identifier as exploited in the wild.

Can I search by camera model?

Yes. A model such as M3005-V maps to its vendor and shows that vendor's camera CVEs. Axis publishes against AXIS OS, Bosch against CPP platforms, so a model hit is not a finding that every listed CVE affects that camera. Confirm the advisory and the firmware actually running. Common current models also live on the camera firmware tracks reference.

Does a listing mean my cameras are vulnerable?

No. It means the vulnerability was published, and the In the wild column says whether CISA has evidence it has been used somewhere. Whether it applies depends on vendor, product, firmware, and whether the management path is reachable.

Why is the Axis, Bosch, and Hanwha KEV count zero?

Those vendors publish camera CVEs, and those rows are in the table. CISA currently lists none of them as exploited in the wild. That is not a claim they have no vulnerabilities.

How often is it updated?

Monthly, or when CISA adds a camera-shaped row or a vendor publishes a new camera advisory. Catalog version on this build is 2026.08.19.

Holding these closed across a fleet

The operational problem is knowing whether any of these products, or firmware old enough to carry them, is still installed. MentatNOC continuously watches firmware currency and credential posture on every camera, runs campaigns in staged waves with automatic rollback, and records every check and change in an audit log built so entries cannot be rewritten after the fact. It monitors device health, not video. The action set is on platform actions, and the fastest way to see a fleet's posture is a live platform demo.