Hikvision cameras provide a REST-based Intelligent Security API (ISAPI) since at least 2018, which enables broad control over device functions. Recent internet-wide scans have been detected targeting the /ISAPI/System/status endpoint, likely to identify devices supporting ISAPI and potentially to aid brute-force password attacks. The API uses Basic or Digest authentication and supports HTTPS and AES encryption, but encryption keys are derived from passwords and the initialization vector is exposed in the URL, rendering encryption ineffective if Basic authentication is used without HTTPS. No full exploit attempts or authentication data have been captured by honeypots so far. The vendor documentation indicates the API is intended for integration with third-party products and is well documented. The recommendation remains to avoid exposing these devices directly to the internet.

The reconnaissance scans can identify Hikvision cameras exposing the ISAPI endpoint, potentially enabling attackers to attempt password brute forcing. If successful, attackers could gain full control over camera settings and management functions via the API. However, no known exploits or active attacks have been observed in the wild according to current data. The impact is primarily the increased risk of unauthorized access if insecure configurations are present, such as weak passwords or lack of HTTPS.

No official patch or fix is indicated. The vendor manages no cloud service remediation for this product. Users should avoid exposing Hikvision cameras directly to the internet and should not place them in sensitive areas. Ensure HTTPS is properly configured with valid keys and certificates to protect authentication credentials. Use strong, unique passwords to reduce the risk of brute-force attacks. Monitor for unusual access attempts and restrict network access to trusted sources.