The most common vulnerability is no security at all. Many brands just:
- put a completely insecure web server onto their devices.
- put plain-text hard-coded passwords into their code for "maintenance access".
- standard issues such as buffer overflow.
- the firmware update functionality is often vulnurable
- signature of an update was in past verified to be a valid signature, but the certificate itself was not checked for validity. So any self signed certificate provided access.
For best practices, try to keep your code simple and authenticate everything. There will probably be no need to include something like a web server in a camera and it brings many vulnerabilities. Also remember, that users may not ever update your firmware, so keeping bugs to a minimum by making the device simplistic is a good idea.
PS: Also authenticate using something like HMAC, as your connection will most likely not be secure. You should avoid sending passwords.
PPS: If you want some sort of developer access, use public key cryptography and always include an option to turn it off.