CVE-2026-167x: Critical Vulnerability Allows Hijacking of Security Cameras in Critical Infrastructure

A critical vulnerability identified as CVE-2026-167x was discovered affecting thousands of security cameras widely used in critical infrastructure — airports, ports, power plants, hospitals and government buildings. The flaw exists in a buffer overflow in the RTSP packet parsing function of firmware from multiple manufacturers. An attacker on the same network can gain full control of the device, enabling surveillance, sabotage, network pivoting and botnet inclusion. Mitigation: isolate cameras in a dedicated VLAN without internet access, use VPN for remote access, block RTSP on the external perimeter, and apply firmware patches as soon as available.