Hikvision Cameras Exposed by Recon Scans for New API Feature
Hikvision cameras have long been a target for hackers due to their vulnerabilities and exposure to internet-wide scans. Now, a new threat has emerged in the form of reconnaissance scans targeting the company’s Intelligent Security API (ISAPI), which was introduced several years ago but has only recently become the subject of these types of scans.
The ISAPI is a REST-based application programming interface that allows third-party products to integrate with Hikvision cameras. It provides access to various features, including camera settings and management capabilities. Despite its name, the API is not limited to AI or facial recognition functions, making it a potentially valuable target for hackers looking to exploit vulnerabilities.
The scans in question are targeting the `/ISAPI/System/status` endpoint, which returns XML or JSON formatted system information. This endpoint is likely used to verify whether a device supports ISAPI and may also be useful for brute-forcing passwords. The API uses Basic or Digest authentication, but most examples seen use XML, which is not encrypted.
The encryption mechanism employed by the ISAPI, which uses AES 128 or 256 in CBC mode, has a significant flaw: it relies on deriving the encryption key from the password, and the initialization vector (iv) is exposed in the URL. This means that if Basic authentication is used and the password is sent in the clear, the encryption does not provide any additional security.
In other words, even with HTTPS enabled, which is necessary to establish a secure connection between devices, hackers may still be able to intercept passwords and exploit vulnerabilities in the API. The scans detected by our honeypots have only targeted this one endpoint so far, but it’s possible that more sophisticated attacks could follow.
The takeaway from this incident is clear: owners of Hikvision cameras must take steps to secure their devices against these types of threats. This includes configuring HTTPS properly and ensuring that passwords are not sent in the clear. As always, we recommend avoiding exposing these cameras to the internet and placing them in sensitive areas where they can be closely monitored.
For users who have already exposed their Hikvision cameras to the internet, it’s essential to review their security settings and take immediate action to mitigate potential risks. This may involve changing passwords, enabling two-factor authentication, or restricting access to the ISAPI endpoint.
Source: SANS ISC — 2026-07-19