Three Advisories, One Gap: Who Patches Cameras and BMS?

Three advisories published in 2026 describe an IP camera, a building management system (BMS) and a family of cloud cameras, and each fix fails to arrive in a different way. Our argument is that an advisory only reduces risk if someone owns three things: the asset inventory that says where the affected product is, the update that fixes it, and the verification that the fix took effect. For all three advisories below, at least one of those is easy to leave without an owner.

We read each advisory on the publisher’s page and quote dates from those pages. We make no claim that any Indian building, city or camera was compromised, or that any particular site runs the affected products. We also have not reviewed tenders, so we do not claim that most of them leave patching unassigned. The gap we describe is visible in the advisories themselves.

Each advisory has a different fix path, and a different place where it can stall

Advisory	Affected	Severity	Fix as published	Who must act	What could go missing (ours)
CERT-In CIVN-2026-0380, 27 Jul 2026[1]	CP PLUS EZ-P21 IP camera, firmware v4.8.8.1 and prior	Critical (CERT-In rating)	Upgrade to firmware 4.8.16.1 “through OTA” (over the air)	Camera owner or administrator	Confirmation the update reached each unit and the version is recorded
CERT-In CIVN-2026-0143, 17 Mar 2026[2]	Schneider EcoStruxure Building Operation (EBO) Workstation and WebStation, older 6.x and 7.0.x versions	High (CERT-In rating)	Install vendor patch, per Schneider’s notice of 10 Feb 2026[3]	BMS owner, integrator or maintenance contractor	A patch window, a test environment and a rollback plan
CISA ICSA-26-288-02, 15 Oct 2026[4]	EseeCloud app up to 4.9.6 and firmware up to 4.9.86.0 (Guangzhou Juan IoT Technology)	CVSS v3 9.8 (CISA)	None listed; the vendor did not respond to CISA’s coordination attempts	Owner of any such camera	An inventory that shows whether the product is present at all

A camera fix by OTA still needs an owner who confirms it landed

CERT-In’s note on the CP PLUS EZ-P21 reports two weaknesses. One is an insecure debug feature that could let an attacker with physical access run code from removable media. The other is improper authentication of HTTP endpoints, which a remote attacker could brute-force to gain unauthorised access to live video snapshots.^[1] The listed fix is firmware 4.8.16.1 through OTA, and affected units are v4.8.8.1 and earlier.^[1]

Our reading is that the physical-access weakness matters in a city, since cameras are often installed on poles or in public spaces where physical access is easier to reach than a server room. That is a general point about cameras, not a finding about this model’s deployments.

The advisory says to upgrade through OTA. It does not say whether the update installs itself, needs an administrator to start it, or depends on the camera reaching the vendor’s servers. We could not tell from the page, and a buyer cannot assume. The questions for a contract are practical: who triggers the update, who confirms each unit reports the new version, and what happens to a camera that was offline when the update went out.

A BMS patch is a project, and the vendor’s own steps show why

The Schneider EBO advisory concerns two flaws reached through TGML graphics files. In each, a local user with low privileges can upload or supply a crafted file, which could lead to file disclosure or denial of service in one case and untrusted code execution in the other.^[2][3] Schneider rates both 7.3 High under CVSS v3.1.^[3]

The vendor’s remediation is manual. For each affected version, the notice tells customers to find the patch in the download centre, download it and follow the readme. It strongly recommends backups and evaluating the patch in a test and development environment or on offline infrastructure first.^[3] If a customer chooses not to patch, Schneider lists interim measures: strong access controls, multi-factor authentication on EBO 7.0 or later, firewalls to separate the BMS network, activity monitoring and the hardening guidelines.^[3]

Our reading is that this turns a patch into a small project with a named owner, a test copy, a backup, a maintenance window and a sign-off. Its timing also shows how long a fix can take to travel. Schneider published its notice on 10 February 2026. CERT-In’s note is dated 17 March 2026, 35 days later.^[3][2] An owner who waited for the national note, not the vendor’s notice, would have started 35 days after the vendor. We do not know when any site applied the patch. Our piece on designing a BMS for a control room treats BMS cyber security as part of the design.

When there is no patch, the inventory is the only control

CISA’s advisory on EseeCloud lists three vulnerabilities, including the use of hard-coded credentials that lets an attacker log in to devices, and its headline CVSS v3 score is 9.8.^[4] Affected products are the EseeCloud app up to 4.9.6 and firmware up to 4.9.86.0. The vendor did not respond to CISA’s coordination attempts, and users are told to contact it for support.^[4] CISA also states that it had no report of public exploitation targeting these vulnerabilities at the time of publication.^[4]

With no vendor fix to apply, the available actions are CISA’s general ones: keep the devices off the internet, put them behind firewalls and away from business networks, and use VPNs where remote access is required.^[4] All of these start with knowing which devices exist, where, and under which brand. A camera can carry a reseller’s brand, so a purchase order alone may not show which product family is inside. We make no claim that this product is deployed in India; the point is what an inventory would let you do within a day.

Four duties, each with a name beside it, close the gap

This is our framework, not a regulatory requirement. For each duty, a contract or operating procedure should say who does it and by when.

1. Inventory. A live list of every camera and BMS server or workstation: model, firmware or software version, location, network segment and owner. Without it, an advisory cannot be matched to anything. Our article on cyber security OEMs matched to the layer notes that CERT-In’s smart city guidelines ask for asset inventory controls.
2. Intake. A named person or team who reads the vendor, CERT-In and CISA advisories for each product on the list, and decides within a stated time whether it applies. Our note on CERT-In’s AI agent alert and smart buildings covers a related CERT-In alert.
3. Fix or isolate. For each applicable advisory, either apply the fix, with test and rollback, or apply the vendor’s interim controls. Where no fix exists, isolate the device or replace it, and record the decision.
4. Proof. A record showing the new version on each device and the date it was confirmed. An update that was sent is not the same as an update that was installed.

The table below is a blank log for your own site. We have deliberately left it empty: the three advisories are the examples and we hold no site data.

Advisory	Date your team first saw it	Date fix or isolation was applied and verified	Days open	Who signed off
CIVN-2026-0380 (CP PLUS EZ-P21)
CIVN-2026-0143 (Schneider EBO)
ICSA-26-288-02 (EseeCloud)
Your next advisory

For the procurement side of camera security, see our note on MeitY’s CCTV security requirements and STQC evidence. Certification speaks to the build that was tested. Patching decides what happens afterwards.

Looking for smarter, secure-by-design video surveillance? Explore aigence AI Video Analytics.

Sources

1. CERT-In, CIVN-2026-0380, Multiple Vulnerabilities in CP PLUS EZ-P21 IP Camera, 27 July 2026
2. CERT-In, CIVN-2026-0143, Multiple Vulnerabilities in Schneider Electric EBO Workstation/WebStation, 17 March 2026
3. Schneider Electric, Security Notification SEVD-2026-041-02, EcoStruxure Building Operation Workstation and WebStation, 10 February 2026
4. CISA, ICSA-26-288-02, Guangzhou Juan IoT Technology EseeCloud, 15 October 2026