Report: Iranian-Nexus Actors Target Middle East IP Cameras for Reconnaissance
Summary
Check Point Research reports Iranian-nexus actors are exploiting known Hikvision and Dahua flaws to target Middle East IP cameras for reconnaissance and battle damage assessment, potentially supporting missile operations.
Key points
- Check Point Research reports increased IP-camera targeting across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.
- The report says actors exploit known Hikvision and Dahua vulnerabilities, including CVE-2017-7921, CVE-2021-36260, CVE-2021-33044, and CVE-2025-34067.
- According to the report, compromised cameras may provide real-time reconnaissance and battle damage assessment for missile operations.
- The report says a camera facing the Weizmann Institute of Science was taken over shortly before a reported 2025 missile strike.
- Researchers observed targeting spikes around regional events and say activity from attributed infrastructure may indicate potential follow-on kinetic activity.
- The article says patches are available for the listed flaws, while many exposed devices remain unpatched.
Article Details
- Event Type
- Reported campaign by Iranian-nexus threat actors to compromise IP cameras across the Middle East using known vulnerabilities.
- Impact
- Compromised cameras reportedly provide real-time reconnaissance and battle damage assessment in support of missile operations. The article says targeting activity has increased around regional events and that widespread exposed, unpatched devices create a persistent reconnaissance network; it presents such activity as a potential indicator of follow-on kinetic activity.
CVE
CVE-2017-7921Hikvision · Ds-2cd2032-i firmware; Hikvision · Ds-2cd2112-i firmware; +56 moreCVE-2017-7921: A legacy improper authentication flaw in Hikvision firmware.CVE-2021-33044Dahuasecurity · Ipc-hum7xxx firmware; Dahuasecurity · Ipc-hx3xxx firmware; +17 moreCVE-2021-33044: An authentication bypass vulnerability affecting multiple Dahua products.CVE-2021-36260Hikvision · Ds-2cd2021g1-i(w) firmware; Hikvision · Ds-2cd2023g2-i(u) firmware; +254 moreCVE-2021-36260: A critical command injection vulnerability in Hikvision’s web server.CVE-2025-34067Hikvision · Integrated Security Management PlatformCVE-2025-34067: A recent unauthenticated remote code execution (RCE) vulnerability in Hikvision’s management platform.
Vendors
Dahuahave intensified campaigns to compromise IP cameras across the Middle East, using known Hikvision and Dahua vulnerabilities to create a realâtime reconnaissance network that supports missile operations and battleHikvisionthreat actors have intensified campaigns to compromise IP cameras across the Middle East, using known Hikvision and Dahua vulnerabilities to create a realâtime reconnaissance network that supports missile
Countries
BahrainThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.CyprusThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.IranAccording to the report, “Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment (BDA) for missile operations, potentially in some cases prior to missileIsraelThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.KuwaitThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.LebanonThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.QatarThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.UAEThe targeting, which began spiking on February 28, spans several countries including Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus.