KISA Tests 10 IP Cameras: Three Fail Basic User Authentication

What the tests found

Evaluators checked 37 items across three areas: the device itself (hardware, network, firmware), the mobile app that controls it, and the manufacturer's policies, including security updates and privacy. Using attack scenarios drawn up by security specialists, they concluded that improvement was needed overall.

In the three cameras with weak authentication, an attacker could download another person's images and video without permission, or forcibly activate or manipulate the camera. On the device side, four models had active exposed test ports that risk system access and data leaks. Eight models did not use secure communication protocols, so user data could leak in transit. Every model had weak firmware security settings.

Five models did not enforce a safe password policy, such as requiring a combination of two character types and at least 10 characters. For six models, the period of security update support could not be confirmed.

Fixes and next steps

KISA recommended that the makers of the three cameras fix the flaws quickly. Fixes are complete for the RoboView and Fineview models, and the third is in progress. All 10 manufacturers received the results and remediation guidance, and have submitted quality improvement plans to the Korea Consumer Agency. KISA will keep checking whether those plans are carried out.

This is the second joint check of everyday digital products, following a 2025 safety survey of robot vacuum cleaners. KISA's Lee Yong-pil said manufacturers and retailers should apply security across a product's whole life cycle, and consumers should practice good security habits.