Hikvision cameras probed via ISAPI status endpoint

The content discusses recent scans targeting Hikvision's Intelligent Security API (ISAPI) identified by Johannes Ullrich. Although Hikvision cameras have a history of vulnerabilities, a new scanning behavior was noted this weekend. The ISAPI, a REST-based API, allows extensive camera control but lacks robust security measures, often using Basic or Digest authentication, and can transmit data formatted in XML or JSON.

Key findings include that the scans target the "/ISAPI/System/status" endpoint to verify device support for ISAPI. The author advises against exposing these cameras to the internet and emphasizes the importance of secure configurations.