Rhodium industry update published 31 October 2026 · ONVIF transition deadline 31 March 2027
ONVIF Profile S: what the 31 March 2027 deadline means for CCTV upgrades
ONVIF says manufacturers will no longer be able to submit new products, or new firmware/software versions, for Profile S conformance after 31 March 2027. The transition concerns an interoperability profile used between IP cameras and clients such as recording or video-management software. ONVIF recommends Profile T and more secure authentication. It says the deadline does not itself stop deployed Profile S systems operating; vendor changes in later firmware can nevertheless affect integrations. Profile T is not identical to Profile S, so a shared ONVIF label is not a complete feature check.
Scope: This is an industry conformance transition, not an Australian legal deadline to replace every camera. Compatibility depends on the exact camera, recorder or client, firmware versions and functions in use. Do not assume every product from one brand has the same profile support.
Before adding cameras or changing firmware
Record the full camera and recorder models and their software versions. Check the exact product/version in ONVIF’s conformant-products database and the manufacturer’s compatibility guidance, including whether the camera and client support the required roles and features. Ask which authentication methods and encrypted connections both ends actually support. Plan a controlled compatibility test of live video, recording playback, audio and events that matter to the installation before a wider update. Follow the vendor’s hardening instructions and keep a recoverable configuration backup under the system owner’s control. Bring model numbers to our Lynbrook showroom for a compatibility discussion; keep passwords and private access codes out of enquiries.
ONVIF: Profile S deprecation questions and answers ↗
ONVIF: Profile S end-of-support announcement, 9 October 2025 ↗
ONVIF: conformant products database ↗
Rhodium industry update published 31 October 2026 · EU main requirements apply 11 December 2027
EU Cyber Resilience Act: the 2027 product-security change Australian camera buyers can watch
The European Commission says the Cyber Resilience Act will apply fully from 11 December 2027 to in-scope hardware and software products made available on the EU market. Some provisions started earlier: manufacturer reporting obligations for actively exploited vulnerabilities and severe product-security incidents began on 11 September 2026. The framework addresses product cybersecurity and vulnerability handling through the product lifecycle. These dates should not be confused with Australia’s separate smart-device security standards, which already commenced in March 2026.
Scope: This is EU legislation, not a new blanket Australian camera-installation rule. Whether a particular manufacturer or product has EU obligations requires a product-specific assessment. It does not establish that a camera sold in Melbourne is certified, affected by a vulnerability or due for mandatory replacement.
Ask about support, not just the camera’s headline specifications
For a new camera or recorder shortlist, ask the manufacturer where security advisories are published, how the supported-update period is stated and how firmware reaches the device. Check the support information for the exact model and market rather than relying on a general brand promise or a CE logo alone. Keep those answers with your equipment list and plan who will monitor advisories and approve maintenance. International product-security programmes may inform a supplier’s roadmap, but obtain model-specific Australian documentation and assess local requirements separately. Review the Commission’s implementation guidance again before relying on the December 2027 deadline for a purchasing or compliance decision.
European Commission: Cyber Resilience Act implementation timeline ↗
European Commission: summary of the legislative text ↗
European Commission: reporting obligations ↗
CVE-2026-10764 published 30 September 2026 · Summary added 31 October 2026
IQSIGHT identifies an information-disclosure issue in BVMS versions through 12.3
IQSIGHT’s product-security index lists advisory IQSIGHT-SA-261342 as high severity. The associated CVE record describes possible information disclosure in BVMS versions 4.5 through 12.3, involving a hard-coded cryptographic key and a man-in-the-middle attack that may expose sensitive data. This notice concerns BVMS video-management software; it does not say every Bosch camera, recorder or alarm product is affected, or that every deployment was compromised.
Scope: Check whether the site actually uses BVMS and confirm its version. A camera’s brand alone does not establish whether this software issue applies. This is a product-specific video-management advisory, not a general CCTV compromise notice.
Check the BVMS version and vendor guidance
Ask the system owner or integrator whether BVMS 4.5–12.3 is installed. If it is, follow the update or mitigation instructions in IQSIGHT’s advisory for that exact deployment and plan the change with the responsible system owner. Confirm the software version after the change and review how video-management traffic is protected. A camera firmware update alone does not confirm that BVMS has been remediated.
IQSIGHT-SA-261342: BVMS Possible Information Disclosure (vendor advisory PDF) ↗
IQSIGHT Product Security and Advisory Center ↗
NIST National Vulnerability Database: CVE-2026-10764 ↗
ASD’s ACSC Annual Cyber Threat Report published 26 October 2026 · Camera-account summary added 29 October 2026
ACSC report highlights account protection for connected camera access
ASD’s Australian Cyber Security Centre 2025–26 Annual Cyber Threat Report says compromised accounts and credentials were one of the most frequently reported incident categories across government, industry and critical infrastructure during the year. Its executive summary recommends that individuals review privacy settings and use multi-factor authentication or passkeys. The report covers cyber threats broadly; it does not report a CCTV-specific compromise.
Scope: This is general account-security advice, not a camera or recorder vulnerability notice. The report does not say camera-viewing accounts were compromised. The practical steps below apply its account guidance to people who use an app or online account for remote CCTV viewing.
Protect the account behind remote camera viewing
If your home security camera system offers remote viewing through an app or cloud account, review that account’s privacy and recovery settings and check who still has access. Use a unique password or passkey, and enable multi-factor authentication if the provider supports it. Remove access you no longer need. These account checks complement camera firmware and network controls; they do not establish that any camera product is affected.
ASD’s ACSC: Annual Cyber Threat Report 2025–26 — executive summary ↗
ASD’s ACSC: Personal cyber security handbook — core security tips ↗
IQSIGHT informational security notice published 14 October 2026 · Summary added 21 October 2026
IQSIGHT warns of public exposure risk in Bosch DIVAR and BVMS video management
IQSIGHT’s 14 October informational notice says Video Recording Manager (VRM) management interfaces may lack an authentication barrier if administrator credentials have not been configured. If a firewall, NAT rule or reverse proxy makes the interface reachable from the public internet, an unauthenticated party may be able to view configuration, connected-device information and video-management data. The notice describes a misconfiguration risk; it does not report a CVE or say every installation is affected.
Scope: The advisory concerns VRM with supported BVMS versions and listed DIVAR IP all-in-one families. It is a video-management configuration notice, not a camera firmware vulnerability or evidence that a system has been compromised.
Checks for an existing CCTV system
Before commissioning or reviewing a Bosch DIVAR/BVMS installation, confirm that VRM administrator access has a strong, unique password. Keep the management interface off the public internet; limit it to a trusted management network or an appropriately authenticated VPN. Ask the system or network administrator to check firewall, NAT and reverse-proxy rules, review account and device changes, and follow current IQSIGHT guidance for the exact product and version.
IQSIGHT-SI-2026-1014: VRM Public Exposure Due to Misconfiguration (PDF) ↗
IQSIGHT Product Security and Advisory Center ↗
Victoria Police release published 13 October 2026 · Summary added 16 October 2026
Victoria Police share vehicle-security advice after key-cloning device seizures
Victoria Police reported on 13 October that it had seized more than 900 key-cloning devices from car thieves across Victoria during the previous year. The release says 23% of the devices were seized in the Southern Metro Region; that is a share of device seizures, not a vehicle-theft rate for a particular suburb. Police also estimate more than 10,000 vehicles are stolen statewide each year using these devices. The update concerns vehicle theft, not a new home-burglary alert or a CCTV product vulnerability.
Scope: A driveway camera can record activity but cannot prevent electronic key cloning or replace vehicle anti-theft measures. The statewide figures do not establish a specific risk for Lynbrook or any household.
Practical takeaway
Follow Victoria Police’s vehicle advice first: lock the vehicle even at home, secure keys, park off the street in a garage where possible, and consider an OBD-port lock or steering-wheel lock. If a home security camera system covers your driveway, test the view from the actual parking and approach points in daylight and after dark, confirm recordings are clear and the camera clock is correct, and keep the view within your property. Preserve original CCTV footage if police request it. Camera coverage is one part of a security plan, not a vehicle anti-theft device.
Victoria Police: More than 900 key cloning devices seized as police letter drop car owners ↗
Victoria Police: Preventing motor vehicle theft ↗
Victoria Police: CCTV installation and positioning ↗
ASD’s ACSC high alert published and reviewed 14 October 2026 · Summary added 15 October 2026
ACSC urges businesses to check internet-connected OT and edge-device exposure
ASD’s Australian Cyber Security Centre (ACSC) issued a High alert on 14 October for Australian businesses and organisations operating internet-connected operational technology (OT), including commercial refrigeration and cooling systems. The alert follows cyber incidents overseas; ACSC says it has not seen active targeting in Australia. It recommends checking internet exposure, applying patches promptly, enforcing strong authentication and access controls, separating networks and monitoring systems. It does not identify a CCTV camera or recorder vulnerability.
Scope: The alert is for OT operators and technical audiences. For a CCTV system, this guidance is relevant only where cameras, recorders or remote-access devices are part of, or connect into, an OT environment. It is not a camera-specific exploit warning.
Practical takeaway
If remote CCTV connects to an operational network, ask the system or network owner to map which devices are internet reachable and how remote administration is protected. Remove unnecessary direct exposure, apply supported security updates, require strong authentication and access controls, and segment camera or recorder traffic from operational controls where the design permits. Review access logs and coordinate any changes with the OT owner so essential services are not disrupted. Check the ACSC’s OT and edge-device guidance for the full scope.
Cyber.gov.au: Protecting operational technology and edge devices ↗
ACSC: Operational technology environments ↗
ACSC: Securing edge devices ↗
ASD’s ACSC alert first published 28 September 2026 · Summary updated 8 October 2026
ACSC updates critical Citrix NetScaler security alert
ASD’s Australian Cyber Security Centre updated its Citrix NetScaler ADC and Gateway alert on 30 September to confirm exploitation reported by Australian organisations. It recommends checking for compromise back to 4 September. A separate 3 October update describes a SAML authentication issue, possible crashes or denial of service, and impacts in Australia. Citrix says that issue depends on the Gateway or AAA configuration and is independent of the original eight vulnerabilities.
Scope: These advisories concern NetScaler gateways. Relevance to CCTV depends on whether that gateway provides access to video management; the sources do not identify a camera or recorder vulnerability.
Practical takeaway
Ask the organisation’s network administrator to identify the appliance, version and SAML configuration, follow the applicable Citrix bulletin and fixed-build guidance, and review logs for compromise. Include any NetScaler path used for CCTV remote access in that review. Camera firmware updates do not address these gateway issues.
Cyber.gov.au: Critical vulnerabilities in Citrix NetScaler ADC and Gateway products ↗
Citrix: Guidance for NetScaler SAML authentication deployments ↗
Citrix security bulletin CTX697096 ↗
ASD’s Australian Cyber Security Centre advisory published 28 September 2026
ACSC advises organisations to secure access to AI services
The Australian Cyber Security Centre says malicious actors are accessing some organisations’ AI services through compromised API keys, authentication tokens, user sessions, vulnerable applications and third-party arrangements. The advisory says this can enable unauthorised use, disruption or exposure of data. It is an organisation-focused AI security advisory, not a report of a CCTV camera vulnerability or a compromise of a camera manufacturer.
Scope: The guidance may matter to businesses that connect AI services with CCTV analytics or other security platforms. It does not say that camera systems are affected; check the actual services, credentials and integrations used in each deployment.
Practical takeaway
For a commercial security system that uses connected AI or video analytics, keep an inventory of service accounts and API keys, assign an owner, grant only the access required, enable phishing-resistant multi-factor authentication where available, store secrets in an approved secrets manager, and review supplier access and audit logs. Apply these controls to the organisation’s AI services and integrations; do not assume a camera firmware update addresses account or token security.
Cyber.gov.au: Protect your organisations’ AI services ↗
Victoria Police release published 25 September 2026 · Summary updated 27 September 2026
Victoria Police investigate a series of offences across bayside and south-east Melbourne
Victoria Police said detectives were investigating a series of 21 offences across Melbourne’s bayside and south-eastern suburbs over five days. The release says two vehicles were stolen in Glen Waverley and later used in offences across the region. Police listed robberies, aggravated burglaries, a burglary, number-plate theft and petrol drive-offs, and asked anyone with information or relevant footage to contact Crime Stoppers. The incidents remain under investigation; the release does not identify Lynbrook as a location or provide a suburb-level risk estimate.
Scope: This is a police appeal about alleged offending across multiple bayside and south-eastern locations, not a crime-rate assessment for any one suburb. CCTV may help provide footage for an investigation, but no camera system can guarantee prevention or identify a person in every condition.
Practical takeaway
Victoria Police recommends basic vehicle-security steps such as locking doors, securing keys and parking in a well-lit area; where suitable, it also suggests a sensor light and CCTV for a driveway. If your home security camera system records an incident, preserve the original footage and its date and time, provide it to police, and do not follow or confront anyone. When planning a security camera installation, check the driveway view, night lighting, camera clock and neighbours’ privacy.
Victoria Police: Police investigate series of offending in Melbourne’s bayside and south-eastern suburbs ↗
Victoria Police: Preventing motor vehicle theft ↗
Victoria Police: Installing CCTV ↗
Victoria Police crime-statistics release published 24 September 2026 · Summary added 26 September 2026
Crime statistics for Victoria: burglaries fell in the year to June 2026
Victoria Police’s 24 September release of Crime Statistics Agency data reports that recorded burglary offences fell by 19.9% in the year ending June 2026, while residential aggravated burglaries fell by 27%. Theft from motor vehicles decreased by 10.4% and theft of motor vehicles by 5.2%. The release says total recorded offences fell 2.1% year-on-year, but remain 13.2% above the level three years earlier. These are statewide figures, not a measure of risk for any particular suburb or household.
Practical takeaway
Use statewide crime figures as context, not as a prediction about an individual property. Victoria Police recommends layered home security, including securing doors and windows, sensor lighting, alarms and cameras. When planning a home security camera system or security camera installation, identify the entry points and driveway views you need, check night lighting and consider neighbours’ privacy before choosing camera locations.
Victoria Police: Crime Statistics Agency data, year ending June 2026 ↗
Victoria Police: Prevent home burglaries ↗
Dahua release published 24 September 2026 · Summary added 26 September 2026
Dahua presents Xinghan AI models at its Smart City Summit
At a summit held in Shanghai on 23 September, Dahua described city-scale operations that bring video, data and services together. In its 24 September company release, Dahua said its Xinghan system combines visual, multimodal and language intelligence, supported by more than 1,600 algorithms and computing from edge devices through cloud services. Examples it listed included video analytics, missing-person searches, traffic-signal optimisation, highway-incident analysis and disaster response. The company also said it has delivered more than 900 smart-city solutions across 70 countries and regions.
Scope: These figures and examples are claims in Dahua’s own release. They describe integrated smart-city solutions, not features guaranteed on every standalone Dahua camera, recorder or installation. Confirm capabilities against the exact models, software, licences and project design.
Practical takeaway
For a commercial CCTV or security-system brief, describe the job the system must do before choosing equipment: what staff need to find or respond to, who may view footage, where recordings are stored, how networks are separated, and what support is required. Check compatibility, licensing, privacy requirements and lifecycle costs across the cameras, recorder, analytics, access control, alarms, intercom and network. For a home security camera installation, choose by viewing area, lighting, recording needs and network conditions; do not assume city-platform AI functions are included.
Dahua: Smart City Summit at Tomorrow.City Shanghai ↗
Rules commenced 4 March 2026 · Buying guidance reviewed 31 October 2026
Australia’s smart-device security standards are now in force
Australia’s smart-device security rules are already in force. Home Affairs says most in-scope devices manufactured on or after 4 March 2026 and intended for personal, domestic or household use must meet baseline security requirements. Products manufactured before that date are not required to meet these particular standards. Coverage depends on the actual product and exemptions, not simply whether a box says smart camera.
Scope: This is current Australian guidance, not a future ban on older cameras. Do not infer compliance or non-compliance from a brand name or sale date alone. Check the manufacturer’s documentation and the Home Affairs scope guidance for the exact product.
A useful checklist before buying a connected camera
Ask for the exact model and relevant statement of compliance, the published security-update support period and the manufacturer’s vulnerability-reporting contact. Check how the device handles passwords and how supported updates are installed. Keep this information with the order and agree who will maintain the system. A compliance statement does not guarantee every installation is secure; account access, supported firmware and network configuration still need attention.
Australian Government: Security Standards for Smart Devices ↗
Source report 21 September 2026 · BYD response reported 23 September 2026
Dahua camera components raise new questions about connected-vehicle security
ABC Four Corners reported that some cameras in Leapmotor C10 vehicles sold in Australia were supplied through a Dahua subsidiary, drawing attention to the difference between connected-vehicle systems and fixed CCTV. The report revisits the removal of Dahua equipment from some federal and Defence locations, but it does not announce a general Australian prohibition on Dahua cameras used in private commercial installations. In separate follow-up reporting, BYD disputed that the broadcast demonstrated a remote-attack vulnerability and said it was reviewing the claims.
Scope: This is connected-vehicle reporting about particular components and sensitive-site concerns. It does not establish that private commercial Dahua CCTV installations are generally prohibited in Australia.
Practical takeaway
For commercial CCTV projects, especially where procurement rules apply, record the exact manufacturer and model, firmware support, network path, storage location, access controls and any required approvals. Ask the customer to confirm their procurement and cybersecurity requirements early. Where a policy excludes a product, document suitable alternatives; no camera brand should be described as universally safe or unsafe without evidence.
ABC News / Four Corners: Dahua cameras in Leapmotor vehicles ↗
CarsGuide: BYD response and review of the claims ↗
Government plan released 22 September 2026 · Summary added 24 September 2026
Victoria releases its Sustainable Data Centre Action Plan
Victoria released its Sustainable Data Centre Action Plan on 22 September 2026, setting expectations for energy, water and planning as the state develops data-centre infrastructure. The government says new developments are expected to match added demand with new renewable generation and storage, meet connection and network-upgrade costs, use recycled or other non-drinking water for cooling, and maintain a 150-metre separation from homes. The plan also addresses residential zoning, schools and childcare sites. ABC reported that planning-regulation changes were still to come and would not apply retrospectively to already approved applications.
Possible relevance for security contractors
For security and technology contractors, this may create future opportunities to tender for data-centre infrastructure work such as access control, CCTV, perimeter detection, intercoms, structured cabling and maintenance. That is a market implication, not a confirmed project pipeline: follow formal tenders and project specifications, and prepare a capability statement that documents system scope, resilience, cybersecurity and support.
Victorian Government: Sustainable Data Centre Action Plan ↗
Premier of Victoria: policy details ↗
ABC News: planning changes and transition details ↗
Related security advice
