NVR security

What an attacker gains from the recorder that they do not gain from any single camera.

An NVR is a machine that logs into other machines. Everything else about its security posture follows from that. It resolves each camera, authenticates over ONVIF or a vendor SDK, opens a stream, writes to disk against a retention policy, and re-serves the archive to clients and phone apps.

A working login for every camera you own#

Dahua's Web 3.0 manual prints the stream URL its devices expect: rtsp://username:password@ip:port/cam/realmonitor?channel=1&subtype=0. The credential is a field in the request. Recording is a pull, the recorder initiates every session, and so for each device on its channel list it has to hold something that will authenticate right now — which is why the box is worth more than the cameras behind it. Cameras do not hold each other's credentials. Take one and you have that camera and whatever the network lets it reach, the surface covered under camera cybersecurity; take the recorder and you have valid logins to the whole channel list, used over connections each camera is configured to accept.

There is at least one documented route from that traffic to an account. CVE-2022-30563 is a replay flaw in Dahua's ONVIF WS-UsernameToken handling, which Nozomi Networks used on an IPC-HDBW2231E-S-S2 dome to replay a captured token thirty hours later from a different address and forge an attacker-controlled administrator. Why the authentication model allows that, and what it implies for anything holding ONVIF credentials, is worked through on ONVIF security.

The recorder also stands on both sides of whatever boundary you drew around the cameras — it has to reach them, and operators have to reach it — so it is the hop a camera-VLAN compromise is looking for. How far real firewall rules diverge from that intent is the subject of camera network segmentation.

Coupling constrains hardening in the other direction too. Hanwha Vision's IP Camera Network Hardening Guide (V4.0, April 2023) tells administrators to move HTTP, HTTPS, RTSP and the proprietary device port 4520 off their defaults, then warns in the same section that doing so "may cause communication problem if there is a connected recording device or VMS". Changing a port on a camera is a change to the recorder's configuration, and the vendor port tables carry the rest.

The recorder answers as well as asks#

A recorder is also something you connect to, and that half tends to be under-scanned because the interesting ports are not web ports. An appliance NVR publishes a proprietary control and management service alongside its web interface — Hikvision's Server Port 8000, Dahua's TCP 37777 — that an HTTP-only sweep will fingerprint as nothing at all. A software recorder publishes more of them: Milestone documents its Recording Server taking client video and PTZ on TCP 7563, and Genetec's Archiver taking live and playback stream requests on TCP 5551 with edge playback on 6051. Milestone's Open Network Bridge serves RTSP on 554 from a Windows host, so 554 answering on a server is not evidence of a camera. Those listeners belong to the VMS rather than to the recorder function; the full tables sit on the ports page.

A recorder reachable through Hik-Connect or Easy4IP will not appear in the router's forward table either. That mechanism, and what it does to an external scan of the site's public address, is covered on how cameras become internet exposed.

NUUO NVRmini2, and a bug with nobody left to fix it#

Jacob Baines of Tenable found two flaws in NUUO's NVRmini2 and NVRsolo recorders, published by CISA as advisory ICSA-18-284-01, last revised 11 October 2018. CVE-2018-1149 is a stack-based buffer overflow (CWE-121). CVE-2018-1150 is leftover debug code (CWE-489), and NVD states what it does without euphemism: NVRMini2 3.8.0 and below "contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists." All versions 3.8.0 and prior were affected. The fix was firmware v3.9.1.

Two authorities scored the backdoor differently and both figures are still in circulation. CISA assigned CVE-2018-1150 a CVSS v3 base score of 10.0 with the scope-changed vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; NVD assigns 7.3, because NVD does not treat it as scope-changed. Which analysis the vendor or the finder endorsed, we could not establish. If a scanner's severity column disagrees with an ICS advisory on a recorder CVE, this is the likelier explanation rather than a stale feed.

CISA's advisory names the sectors the product had been deployed into: commercial facilities, financial services, government facilities, healthcare and public health, and transportation systems, worldwide, with the vendor headquartered in Taiwan.

Recorders CISA has seen exploited#

As of KEV catalog 2026.09.04 (1,695 entries):

The catalog also carries QNAP VioStor, Digiever and D-Link NVR entries. Both NUUO rows are terminal. Six years after the Peekaboo fix shipped, the required action for these is not to patch but the wording CISA reserves for abandoned products — "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product." Three of the four are logic failures in device web code — command injection, missing authentication — rather than memory corruption; across the 22 video entries in the catalog the same class dominates.

The support clock, and what nobody has measured#

Dahua's Product End-of-Life Policy, last modified 27 October 2025, commits to "the security updates for at least 2 (TWO) years after the first shipment for sale of certain Dahua Products." Two clauses in that sentence do work most readers skip: the clock starts at first shipment rather than at your purchase order, and it is scoped to certain products rather than to the catalogue. Comparative vendor clocks are tabulated under end-of-life cameras, and boot-level research on Dahua recorder hardware is on the DVR page.

S-RM's March 2025 account of an Akira intrusion is the nearest published thing to a recorder story, and it is not one. The actor entered through an externally facing remote access solution and was blocked when EDR quarantined the encryptor on a Windows host, then scanned internally, found a webcam running a lightweight Linux operating system that supported command execution, and ran the Linux encryptor from the camera against SMB shares. The camera was the execution host, not the entry point; much of the secondary coverage has that backwards. We found no primary incident-response source documenting an NVR as the initial entry point in a ransomware intrusion.

The question an incident actually turns on — what an appliance recorder records about its own administration, whether exporting an archive leaves a trace, and where any of that is forwarded — we could not answer from vendor documentation. None of the manufacturer material read for this page publishes an audit-log schema or a retention period for one. That is a gap in the published record rather than a finding about the devices, and it is the sort of thing to settle empirically: export an archive on the model in front of you, then go looking for the entry that proves you did.