Avast carried out the check to coincide with the first day of the Mobile World Congress trade show in the city.
In addition, it said it had found more than 470,000 other types of vulnerable smart devices.
The firm warned that unsuspecting owners could be spied upon as a consequence.
"If webcams are set to livestream for example, hackers or anyone can connect making it easy for cybercriminals to spy on... oblivious school pupils, workers or citizens nearby," said the firm's chief executive Vince Steckler in a statement.
"[But] what is far more likely is the possibility of a cyber-crook hijacking an insecure webcam, coffee machine or smart TV to turn it into a bot which, as part of a wider botnet, could be used in co-ordinated attacks on servers to take down major websites."
Avast used the connected-objects search engine Shodan to identify the devices.
It said to qualify they needed to either:
It carried out the study to help promote its own security tools.
But another independent expert said he thought the public needed to be aware of the threat.
"This research underlines just how easy it is to locate potentially vulnerable 'smart' devices and how they might be compromised," said Ken Munro, from the cybersecurity testing specialists Pen Test Partners.
"That's not to say that all internet-connected devices can be easily compromised; for example some more recent kettles, coffee machines and fridges are much harder to hack than earlier models.
"But consumers should exercise caution with smart devices. Ask yourself first if you actually need that device, then think about what data it might collect about you and expose.
"For example, baby monitors with video and two-way audio would obviously be more concerning than a simple audio-only device."

Gerard Devlin, of Donegall Road, and Nathan Finn, of Malone Road, were each given a three-year sentence for taking more than £5,700 from the woman.
Their 80-year-old victim was left "deeply traumatised" by the theft at the Kennedy Centre in Belfast last year, the court heard.
The men will serve 18 months in prison with the remaining period on licence.
The court heard that the pensioner had withdrawn her life savings on 31 October 2014, the day of the theft, and had planned to use the money for home improvements.
She then visited a coffee shop in the shopping centre.
As she was queuing, Finn, 22, distracted her.
Devlin, 25, reached into her handbag and stole a plastic bag containing £5,709 in cash.
The money was never recovered, the court was told, and while the two men admitted the theft they have not said what happened to the money.
The judge said there was "no doubt" the men they had "deliberately targeted" the woman.
She added that the woman has "suffered a great deal" as a result of the theft.
Finn committed the offence within days of being released on licence for a previous matter, the court heard.
The judge said Devlin had written a letter to the woman earlier this year, but she questioned whether the remorse the two men had expressed since the offence was genuine.
A leading security company says it has discovered 22,000 hackable internet-connected baby monitors and other types of webcam in Barcelona.
[NEXT_CONCEPT]
Two Belfast men who stole a pensioner's life savings have been jailed for their "despicable" behaviour".