Camera Network Segmentation: Lessons From Two Camera Flaws

By Leo, woCyber — writing about local-first storage, private cloud and DIY home security.

Do security cameras need their own network?

Key Takeaways

• The Tapo authentication-bypass flaw recorded as CVE-2026-15315 carries a CVSS 8.8 score and requires the attacker to already sit on your local network (NVD). Camera network segmentation removes exactly that precondition.
• The Hikvision command-injection flaw CVE-2021-36260 scores 9.8, sits in the CISA known-exploited catalog, and drew a fresh wave of exploitation attempts between 23 September and 1 October 2026 (NVD, RootShell).
• Segmentation is a configuration task, not a purchase. A guest network or an IoT SSID costs zero and takes twenty minutes.
• Most cameras in this class, including the 2.4G/5.8G dual-band models in our range, record to a 256 Gigabyte local card, so an isolated camera can still be a useful camera.

The Short Answer

Camera network segmentation is the practice of putting cameras on their own network segment so they can talk to your recorder but not to your laptops, phones and files.

Apply one rule: if a device has a web login and you would not plug a stranger’s laptop into it, it does not belong on the same segment as your work computer.

Cameras fail that test almost every time. They run a web server, they keep a default password far longer than a laptop does, and nobody reboots them for a decade. That combination is why the two flaws above matter more on a flat home network than their scores suggest.

Why is this back on the buyer’s desk this month?

Two separate stories landed within days of each other, and they point at the same conclusion from opposite ends.

The first is a GreyNoise analysis, summarised by RootShell on 12 October, describing a surge in exploitation attempts against Hikvision devices in Ukraine between 23 September and 1 October 2026. The traffic targeted CVE-2021-36260 — a command-injection flaw in the camera web server, scored 9.8 by NIST, added to the CISA known-exploited catalog back in January 2022 — and most of it came from four addresses, three of them commercial VPN exits. The reported requests carried a file-reading test command rather than a malware payload, which reads as probing rather than a confirmed takeover (RootShell, CISA KEV).

The second is quieter and closer to home. NVD published records in August 2026 for two Tapo camera flaws: an authentication bypass in the login module (8.8) and an input-validation crash in the configuration service (6.5) that can reboot the device with oversized ciphertext. The first one hands out administrative session tokens to an attacker who is already inside your network. Not from the internet — from your network (NVD, NVD).

A four-year-old critical bug still worth attacking, and a fresh bypass that starts from the inside. Neither one cares how good your laptop’s antivirus is.

What does segmentation actually stop?

It does not patch anything. It changes where an attacker has to stand.

For the Tapo bypass, the network-adjacent requirement is the whole story: an attacker on your LAN can reach the login module, an attacker outside it generally cannot. Put the cameras on their own segment and the flaw is still there, but the path to it runs through your router’s rules instead of your printer.

For the Hikvision flaw, the protection is weaker and I want to be honest about that. A 9.8 remote flaw in a camera that is itself port-forwarded is reachable regardless of your internal segments. Segmentation helps when the camera is reached laterally, from a compromised device inside the network — which is the scenario in most real incidents, and the reason the guidance keeps repeating.

That middle row is the one most homes and small shops are living in right now.

How do you separate cameras without a second router?

1. Start with the guest network you already have. Almost every router made in the last six years offers a guest SSID. Put the cameras on it, turn off “allow guests to see each other” if the option exists, and the cameras are already isolated from your laptops.
2. Check the band before you move anything. Many battery cameras in this class are 2.4G-only devices, while others are 2.4G/5.8G dual-band. If your guest network is 5GHz-only, a 2.4G camera will not join it and you will spend an evening blaming the camera.
3. Decide what the cameras still need to reach. A recorder or NAS, usually. Some routers let you allow one destination from the guest segment; if yours does not, the recorder can live on the camera segment instead, which is the better trade anyway — the files end up next to the cameras rather than next to your tax returns.
4. VLANs if your router supports them. Same idea, cleaner rules, and you can allow exactly one port to the recorder. Worth an hour if you run a shop or an office.
5. Drop the port forward. This is the step that actually closes the Hikvision-style exposure. Remote viewing through the vendor’s app or through a VPN into your network beats an open port on 554 or 8000 every time.

Total spend: nothing. Total time: an evening, most of it spent walking around with a phone checking which SSID each camera joined.

Where does the storage side come in?

Segmentation changes where recordings live, and it is worth deciding deliberately rather than by accident.

A camera that keeps its footage on a 256 Gigabyte local card needs nothing from your main network — no cloud account, no upload, no inbound rule. That is how the cameras in our range are specified, and it is the reason an isolated camera stays useful instead of turning into a plastic ornament. When the retention window outgrows the card, a recorder on the camera segment takes over; the NAS Security Kit is that pairing, camera line plus local storage specified together. Either way, cameras that keep recording without internet behave exactly the same once the uplink is gone.

The configuration habit matters more than the hardware here, and the firmware update routine is the other half of it — segmentation buys you time, patches close the door.

Where does segmentation quietly fail?

• The printer joins the camera segment. Guest segments fill up with whatever was awkward to set up, and each new device widens the blast radius again.
• The recorder gets forwarded “temporarily”. Temporary forwards outlive the holiday they were set up for.
• Nobody knows which camera is on which SSID. Six months later, one camera silently re-associates to the main network after a factory reset, and the map in your head stops matching the house.

Write the segment map down. One line per device. It sounds like bureaucracy until the evening you need it.

What would I actually do?

For a house: guest SSID for cameras, recorder on the camera side, no port forwards, and a calendar reminder to check firmware quarterly. That is the whole plan, and it costs the router you already own.

For a shop or a small office with four or more cameras, a VLAN and a proper recorder pay for themselves in the first audit — but only if someone owns the configuration. Segmentation that nobody maintains is a diagram, not a control, and it degrades to the middle row of that table within a year.

What I would not do: buy a second router before checking whether the guest network solves it. I see that purchase made in panic, and the resulting two-network household is harder to keep patched than the flat one it replaced.

What We Don’t Know

Vendor firmware timelines for the two Tapo flaws are the open question here — we know the records were published in August 2026, and we do not know which firmware versions you should treat as clean without checking your own model against the vendor’s advisory. Treat that check as part of the setup, not as an afterthought.

FAQ

Does camera network segmentation require new hardware?

Usually no. A guest network on your existing router isolates cameras from your computers, and VLAN support covers the rest. A dedicated router or a managed switch earns its place only in larger installations with more than a handful of cameras.

Will segmentation stop all camera attacks?

No. It removes the local-network path to a flaw and limits lateral movement. A camera that is port-forwarded to the internet is exposed regardless of segments, which is why dropping port forwards matters as much as the segmentation itself.

Can cameras still record if they are on a separate network?

Yes. Recording happens between the camera and its storage — a local card or a recorder on the same segment. Neither depends on reaching your laptops or the internet.

Is this something a home user really needs?

If the cameras hold footage of your property and your main network holds your files and banking, the two do not belong together. The configuration is free, so the honest question is not whether you can afford it but why the default flat network is still running.

What to do next

Check two things tonight: which SSID your cameras are actually joined to, and whether any camera port is forwarded on your router. If the answers are “the main one” and “yes”, you have an evening of work that changes your exposure more than any camera upgrade would.

If you would rather have the camera and storage side specified as one system, tell us how many cameras and how long you need to keep the footage, and we will size it — local recording, no monthly plan.