A vulnerability (CVE-2023-2345) in the camera’s embedded web server allowed unauthenticated access to /system/logs/plain . Attackers downloaded logs containing Wi-Fi credentials and NVR admin hashes . They then pivoted to the payment card environment.

To ensure your surveillance system remains secure, follow these steps:

Set a monthly patching cadence. Subscribe to your vendors’ security bulletins. Test before you deploy. And never, ever let a networkcamera go more than 90 days without checking for a patch.