Industrial-grade surveillance cameras are supposed to be the eyes of a secure facility — but a newly disclosed set of vulnerabilities in Brickcom network cameras has effectively handed those eyes to anyone on the internet. Security researchers have confirmed critical flaws across four Brickcom camera product lines that allow unauthenticated remote attackers to watch live feeds, harvest still images, and potentially commandeer the devices entirely. For organizations operating in sectors where physical security intersects with cyber risk, this is a serious wake-up call.
What's Broken — and Why It Matters
The vulnerabilities affect Brickcom's Cube, Dome, Bullet, and Box camera models, all running firmware version 3.2.3.5.6. Two distinct weakness classes have been identified: missing authentication for a critical function, and the use of default credentials. Together, these flaws create a dangerous attack surface that requires no prior access, no credentials, and no specialized knowledge to exploit.
The first flaw, tracked as CVE-2026-50245, allows any unauthenticated user to retrieve live snapshot images directly through the device's ONVIF endpoint. ONVIF is a widely adopted industry standard for IP camera interoperability — meaning this isn't an obscure feature. It is a core communication pathway that administrators commonly rely on, now weaponized by the absence of even basic access control.
The second class of vulnerability stems from hardcoded or default credentials that remain active on affected units. Attackers who move beyond passive image retrieval can leverage these credentials to gain full administrative control of the device — enabling them to alter configurations, disable recording, redirect footage, or pivot the camera as a network foothold for deeper infiltration.
"A camera that can be hijacked without authentication isn't a security tool — it's a liability. In environments where visual intelligence is operationally sensitive, these flaws represent a direct threat to both physical and cyber safety."
Who Is at Risk
Brickcom cameras are deployed globally across sectors that regulators and security professionals classify as critical infrastructure. The affected device categories include installations in:
The manufacturer, headquartered in Taiwan, distributes these products internationally — making the vulnerability's impact truly global in scope. Organizations that assume their cameras are passively inert are fundamentally misunderstanding the threat model. IP cameras are networked endpoints, and they carry all the risks of any other internet-connected device.
The Broader Problem With IoT Security Debt
What makes this disclosure particularly troubling is that neither vulnerability requires sophisticated exploitation. Missing authentication and default credentials are not novel attack vectors — they are mistakes the industry has been warned about for over a decade. Yet they continue to appear in production firmware across commercial IoT devices.
Default credentials are especially pernicious because they are often documented in publicly available product manuals and shared in attacker forums. Once a vulnerable model is identified on the internet — through tools like Shodan or Censys — mass exploitation requires little more than automated scripting. The barrier to entry is essentially zero.
The CVSS v3 score of 7.7 reflects the severity clearly: high impact, low complexity, no privileges required. In practice, the operational consequences could be far worse than the score suggests, particularly in environments where video intelligence has direct bearing on physical security posture.
What You Should Do
- Audit your camera inventory immediately. Identify any Brickcom Cube, Dome, Bullet, or Box units running firmware version 3.2.3.5.6 across all facilities and network segments.
- Apply firmware updates without delay. Check with Brickcom or your device management platform for patched firmware releases addressing CVE-2026-50245 and the default credential vulnerabilities.
- Change all default credentials now. Even before patching, rotate any factory-default usernames and passwords on affected and adjacent devices. Use strong, unique credentials for every unit.
- Isolate camera networks. Place IP cameras on dedicated VLANs with strict firewall rules. Camera endpoints should never have direct internet exposure or unrestricted lateral access to corporate networks.
- Audit ONVIF exposure. Review which services are exposed on camera devices and disable any endpoints that are not operationally necessary.
- Monitor for unauthorized access attempts. Enable logging on camera management platforms and integrate alerts into your SIEM for unusual authentication patterns or configuration changes.
- Include IoT devices in vulnerability management programs. IP cameras are often excluded from patch cycles and asset inventories — a gap attackers actively exploit.
The intersection of physical security technology and cyber vulnerability is one of the most underappreciated risk domains in enterprise security. Cameras, access control readers, and building management systems often run legacy firmware with minimal oversight — yet they sit on the same networks as sensitive business systems. Brickcom's disclosure is a reminder that the attack surface doesn't end at the firewall. It extends to every device with an IP address and a lens.
