Instead of exposing the raw index.shtml , put the CCTV behind a reverse proxy (like NGINX or Cloudflare Tunnel) that requires 2FA before the server is even reached.

: To view cameras remotely, users often enable port forwarding on their routers. If the camera's web server is not secured, search engines like Google or specialized tools like Shodan index them.

Never use the username or password that came in the box. Use a strong, unique password.