Chinese cameras: what the authorities actually say

Czechia: the first state document to name the vendors

On 29 August 2025 the Czech cyber security agency NÚKIB published a nineteen-page strategic analysis naming Hikvision and Dahua directly. Its conclusion uses the agency’s standard probability scale: it is probable (55–70 %) that some of the cameras are to some degree compromised by Chinese authorities.

A formal warning followed on 3 September 2025 — an instrument with real legal weight. Threat level: high. It covers the transfer of system and user data as well as remote administration from China, and it lists IP cameras first. It is not a ban. But entities regulated under Act 264/2025 Coll. must factor the threat into their risk analysis.

Sources1 NÚKIB analysis2 NÚKIB warning3 Act 264/20254 investigace.cz

Slovakia: no warning of its own

Slovakia has no equivalent analysis or warning. Its National Security Authority points to Brussels: according to spokesperson Kristína Petro Garaiová, Slovakia will respect and implement measures adopted at EU level.

That has a practical consequence. In Czechia there is a domestic document to lean on, both when analysing risk and when defending a decision. In Slovakia the binding rule does not exist yet — and it will come from the EU.

Sources5 STVR6 Denník N

The EU and Lithuania: from advice to a binding list

On 20 January 2026 the European Commission tabled a proposal revising the Cybersecurity Act. For the first time it introduces a horizontal framework for ICT supply chain security and allows third countries and named suppliers to be designated high-risk across 18 critical sectors.

The proposal names no company. But it is precisely the mechanism through which a ban could arrive — and once adopted it anticipates roughly three years to remove high-risk suppliers’ equipment. Lithuania did not wait, restricting Chinese cameras across hundreds of public bodies years earlier.

Sources7 EC proposal1 NÚKIB analysis

The US and Canada: from restriction to revoked approvals

On 27 June 2025 Canada ordered Hikvision to wind up its Canadian operations under the national security provisions of the Investment Canada Act, alongside a procurement ban for federal bodies and an audit of already installed equipment. Hikvision challenged the order; its motion for a stay was dismissed.

In October 2025 the FCC went further than before, enabling revocation of approvals already granted rather than only blocking new ones. Major retailers then pulled millions of listings. For operators, the practical risk is spare parts and expansion — installed cameras did not stop working.

Sources8 Canada9 FCC

What the manufacturers say — and why it is not enough

Hikvision’s position is consistent and public: it has never intentionally contributed to the placement of backdoors in its products, and it is not a threat to national security. The company is contesting both the US and Canadian measures in court.

The most honest finding in the whole NÚKIB analysis is that it partly agrees. The number and severity of vulnerabilities in Chinese cameras are comparable to other manufacturers, Axis included. The problem is not how many bugs there are — it is who hears about them first.

Sources10 Hikvision1 NÚKIB analysis

What one of these cameras looks like inside

Hardware security researcher Matt Brown extracted the firmware from a cheap Chinese IP camera and took it apart. Inside: Linux with BusyBox, hard-coded Chinese server addresses, and a hard-coded root password hashed with descrypt — a scheme dating from the 1970s.

In follow-up work he showed more: the device does not verify the certificate chain, so intercepting traffic between camera and cloud succeeds. He then reconstructed the video from captured packets. His own conclusion, though, is more sober than the headlines — which is exactly why it is worth quoting.

# hard-coded in the firmware:
root:<hash>:0:0:root:/root:/bin/sh      # descrypt, a 1970s algorithm
devaccess.easy4ipcloud.com              # cloud address in the binary, not changeable

Sources11 Matt Brown 112 Matt Brown 213 Hackaday

The vulnerabilities actually being exploited

Theoretical risk is one thing, documented exploitation another. For Hikvision cameras both exist, and both vulnerabilities below have confirmed real-world exploitation.

Both have long been patched. So what matters is not that the flaw exists, but how many devices never received the update — and how many of those are reachable straight from the internet.

Sources14 CVE-2021-3626015 CISA KEV1 NÚKIB analysis

The cloud: where your video actually sits

The most common misconception is “the camera is behind a firewall, nobody can get in.” Services like Hik-Connect, EZVIZ and Imou run on P2P — the camera opens the connection outbound. The firewall sees ordinary outbound traffic and allows it. Remote access then returns down that same tunnel, without you ever opening a port.

Where the data ends up is not a matter of guesswork; the vendors describe it in their own policies. EZVIZ lists servers in China, Ireland and other jurisdictions. Hikvision states that staff in mainland China have restricted remote access to personal data for support purposes, with Standard Contractual Clauses as the legal basis for the transfer.

Sources16 EZVIZ17 Hik-Connect1 NÚKIB analysis

What it actually costs

Price is the main reason Chinese cameras get bought, so we did not rely on general estimates. Below are real listings from Czech retailers, verified on 6 August 2026, in a comparable class: outdoor bullet IP camera with PoE.

The result is not what is usually claimed. The cheapest camera in the table is not Chinese. The Chinese vendors have a price advantage only against a premium Axis — against Taiwan’s Vivotek or America’s Ubiquiti they have none at all.

Sources18 ESCADTRADE19 VAKAP20 Axilogi21 bscom.cz