Vulnerabilities in digital video recorders attached to closed-circuit TV security systems could let hackers watch, steal or delete video footage, researchers say.
The flaws could also be used as a point of entry for attacks on any computer systems connected to the DVRs.
The flaws are found on DVR-based multi-camera security systems from an estimated 19 manufacturers, all of which use firmware provided by China-based Ray Sharp.
The flaws came to light last week after a hacker known only as " someLuser " discovered that certain commands sent to a Swann DVR were accepted without authentication.
Those commands gave someLuser access to a Web-based control panel making Universal Plug and Play-enabled devices visible and unprotected on the open Web.
Coincidentally, Boston security firm Rapid7 this week revealed flaws in the Universal Plug and Play protocol that left tens of millions of printers, network routers, storage drives and other devices open to attack.
[ Critical Flaws Found in Millions of Home, Office Devices ]
To make matters worse, someLuser found that Ray Sharp firmware didn't encrypt usernames or passwords, which would make it easy to potentially access and manipulate CCTV feeds over the Internet.
HD Moore of Rapid 7 saw someLuser's blog post and examined vulnerable CCTV systems country by country.
Moore found 58,000 vulnerable CCTV DVRs connected to the Internet, with the largest number of at-risk systems in the United States, followed by India and Italy.
The CCTV exploit "provides remote, unauthorized access to security camera recording systems," Moore said in a company blog posting Monday (Jan. 28).
SomeLuser made news last year when he showed how to tap into the live feeds of Internet-connected security cameras around the globe simply by manipulating a URL in a Web browser. Many of those feeds are still live today.