21,786 Home Cameras, No Password, No Warning

Key Takeaways

• 21,786 cameras stream live video without authentication
• Budget recorders like webcamXP open 45.6% of time
• RTSP protocol accounts for 9,746 unauthenticated feeds
• Japan and US host over one‑third of open streams
• Regulators banned default passwords, legacy devices stay vulnerable

Pulse Analysis

The explosion of affordable Internet‑of‑Things cameras has outpaced security best practices, leaving millions of households exposed to passive eavesdropping. While premium brands such as Hikvision and Dahua now enforce mandatory password creation, the cheap segment—often built on HiSilicon‑class chipsets—continues to ship with default credentials or no authentication at all. Researchers scanning the public internet in 2026 uncovered nearly 22,000 live feeds that anyone can view, a stark reminder that the convenience of low‑cost surveillance comes with a hidden privacy cost.

Regulatory responses have begun to address the root cause: California outlawed default passwords in 2020, and the UK’s Product Security and Telecommunications Infrastructure Act followed in 2024. However, these measures only protect devices sold after the bans; the vast legacy pool remains vulnerable. The Mirai botnet’s 2016 campaign demonstrated how default credentials can be weaponized at scale, and its descendants still probe the same weak devices today. The report’s data shows that cheap recorders and legacy webcam applications dominate the open‑feed landscape, with RTSP—a protocol designed for streaming, not security—serving as the primary conduit for unauthenticated video.

For consumers and enterprises, the remediation path is straightforward but often ignored. Setting a strong, unique password during initial setup, disabling UPnP, turning off unused RTSP streams, and applying firmware updates can close the most glaring gaps. Choosing cameras that rely on encrypted cloud relays rather than inbound ports further reduces exposure. As the market matures, manufacturers that embed security by design will command a premium, while the low‑end segment may face declining demand as privacy‑conscious buyers seek safer alternatives.