The Weakest Part of Most CCTV Systems Is the Network Behind It

On 4 March 2026, it became unlawful to supply a new smart home camera in Australia with a shared default password.

The Cyber Security (Security Standards for Smart Device) Rules 2025, made under the Cyber Security Act 2024, commenced that day after a twelve month transition. They impose three obligations on manufacturers: no universal default passwords, a published channel for reporting security issues, and a published support period with an end date for security updates.

Here is the part that matters for a business. The Rules apply to devices intended for personal, domestic or household use. The camera on a homeowner’s front door is covered. The system watching your warehouse, specified and installed as commercial equipment, very likely is not.

Which means the minimum standard now exists for consumer gear and does not exist for yours. You have to impose it yourself.

Source: Department of Home Affairs, Security Standards for Smart Devices. Whether a specific commercial product falls inside or outside the Rules depends on section 8 of the instrument and how the product is intended to be used, so treat the boundary as a question for your supplier rather than an assumption.

A camera is a computer with a lens. The recorder is a computer with hard drives. Both run an operating system, both have accounts and passwords, and both are usually installed by somebody whose expertise is mounting and aiming rather than network security.

That gap is where most CCTV systems are actually exposed. Not through the lens. Through the network.

The short answer

Four things account for most of the risk, and all four are fixable without replacing hardware.

1. Default or shared credentials that were never changed.
2. The recorder reachable from the internet, usually through port forwarding set up to make the phone app work.
3. Cameras on the same flat network as everything else the business runs.
4. Firmware that has not been updated since installation.

None of these requires a sophisticated attacker. They require somebody who knows what to look for, and automated tools have been looking for years.

Why this matters more for cameras than for other devices

Three reasons a compromised camera system is worse than a compromised printer.

It watches your premises. Access to the recorder means access to live views of your building, your staff and your stock, plus the stored history.

It is a foothold. A device inside your network that nobody monitors is an excellent place to stage from. If the cameras share a network with point of sale, accounting or patient systems, the camera is now a route to those.

Nobody is watching the watcher. Businesses notice when a laptop behaves strangely. Almost nobody notices unusual behaviour on an NVR, because nobody is looking at it unless footage is needed.

The four problems, and what to do about each

1. Credentials

The installer sets up the system, creates an admin account, and often uses the same password they use on every job so support calls are simple. Staff get a shared login. Nothing changes for five years, including after the installer’s technician leaves.

What to do:

• Change the admin password and do not reuse one from another system.
• Create separate accounts for people who need live view only, rather than sharing admin.
• Remove accounts belonging to people who have left, including former contractors.
• Ask your installer directly whether they retain remote access, and under what account. There are legitimate reasons for a maintenance account to exist. There is no legitimate reason for you not to know about it.

2. Internet exposure

Somebody wanted to view cameras from a phone. The quickest way to achieve that was to forward a port on the router to the recorder. It worked, so it stayed.

That recorder is now reachable from anywhere in the world, and it is being scanned continuously.

What to do:

• Find out whether any ports are forwarded to the recorder. Your IT provider can answer this in minutes.
• If remote viewing is needed, use the manufacturer’s proper cloud relay service or a VPN into the network rather than exposing the recorder directly.
• If a port must be open, restrict it by source address.

This is the single highest-value item on the list. Closing direct exposure removes most of the realistic risk.

3. Flat networks

On many small and mid-sized Melbourne sites, everything shares one network. Cameras, the recorder, the office computers, the guest WiFi, the EFTPOS terminal and whatever a contractor plugged in last March.

What to do:

• Put cameras and the recorder on their own network segment or VLAN.
• Allow only the traffic that needs to cross between segments.
• Keep guest WiFi genuinely separate from everything.

This is ordinary network design rather than anything exotic, and on a new installation it costs very little. Retrofitting it is more work, which is why it is worth specifying at the point of purchase.

4. Firmware

Camera and recorder manufacturers publish firmware updates, including security fixes. Most systems never receive them, because nobody owns the task.

What to do:

• Ask whether firmware updates are included in your maintenance arrangement. If you have no maintenance arrangement, that is the finding.
• Ask for the published support period end date. Consumer device manufacturers are now required to publish one, and there is no reason a commercial supplier cannot tell you the same thing. A product that stopped receiving updates three years ago will not start again.
• Ask where security issues are reported. Again, consumer manufacturers must now publish a contact. Commercial vendors should be able to answer the same question.
• Treat support life as a purchasing criterion alongside image quality. It is the one specification that decides how long the system stays safe to own.

The questions to put to your installer

Four questions, and the answers are revealing.

1. Is the recorder reachable from the internet, and how?
2. Which accounts exist on the system, and who holds the credentials?
3. Are the cameras on a separate network segment from our business systems?
4. Who is responsible for firmware updates, and when was the last one applied?

An installer who answers all four clearly is doing the job properly. An installer who treats the questions as unusual has told you something useful.

The compliance connection

This is not only a technical matter.

Footage of identifiable people is personal information, and in some settings it is sensitive. If a system is compromised, the question of whether reasonable steps were taken to protect that information becomes a live one. Default passwords and a recorder open to the internet are difficult to characterise as reasonable steps.

The documentation obligations that apply when analytics are switched on are covered in AI cameras and the 2026 privacy rules. The security of the system holding that footage sits alongside those obligations rather than separately from them.

Common misconceptions

“The cameras are not connected to the internet.” The recorder almost certainly is, otherwise the phone app would not work. The recorder is the device that matters.

“We are too small to be a target.” Internet-wide scanning does not select targets by size. It finds exposed devices and tries known default credentials. Small sites are frequently more exposed because nobody is managing them.

“Our IT company handles that.” Sometimes true. Frequently the cameras were installed by a security firm, the network is managed by an IT provider, and neither believes the recorder is theirs. Establish which it is.

“The system is new, so it is fine.” New hardware ships with default credentials and known firmware versions. New is a starting point.

“A VPN is too complicated.” Most business routers support one, and the manufacturer cloud services for current CCTV platforms are designed precisely so that port forwarding is unnecessary.

A short audit you can run this week

No specialist tools required.

1. Ask your IT provider whether any ports are forwarded to the camera recorder.
2. Log in to the recorder and list the user accounts. Identify every one.
3. Check when firmware was last updated. If the answer is never, note the model numbers.
4. Ask whether cameras are on the same network as business systems.
5. Confirm whether your installer has retained remote access, and whether you want them to.

Most sites find at least one item worth addressing. The port forwarding question is usually the one that matters.

Frequently asked questions

Can CCTV systems really be accessed from outside? Yes, where the recorder is exposed to the internet and credentials are weak or default. This is a well-documented category of exposure rather than a theoretical one.

Does a separate network for cameras cost much? On a new installation, usually very little, because it is a configuration decision rather than extra hardware. Retrofitting to an existing flat network takes more effort.

Should my installer have remote access to my system? It is reasonable for maintenance, and it should be a named account you know about, with credentials that can be revoked when the relationship ends. The problem is undisclosed access, not access itself.

How often should firmware be updated? When the manufacturer publishes updates addressing security issues, and as part of a scheduled maintenance routine rather than ad hoc.

Does this apply to a system with only a few cameras? Yes, and often more so, because smaller systems are less likely to be professionally managed after installation.

Where this leads

Security systems are now network systems. Treating the cameras as a standalone product and the network as somebody else’s responsibility is how most of this exposure arises.

Forever Secure covers network and WiFi alongside CCTV, alarms, access control and intercoms. The practical consequence is that cabling, segmentation and remote access sit inside one conversation rather than falling into the gap between a security installer and an IT provider, which is where these problems usually live. A free on-site assessment looks at how a system is connected as well as where the cameras point.

Book a free on-site security assessment or call 1300 232 152