Hackers Exploit Hikvision Camera Flaw to Steal Sensitive Data

Security researchers have observed renewed exploit campaigns targeting an eight-year-old backdoor in Hikvision cameras to harvest configuration files, user lists, and snapshots. Attackers automate scans across IP ranges, appending a base64-encoded “auth” parameter to management URLs, which when decoded commonly reveals “admin:11” and enables unauthorized access. Organizations relying on older camera firmware are at heightened risk of data leakage, including configuration data and credentials.

First assigned CVE-2017-7921, the flaw stems from a hidden endpoint in Hikvision IP cameras that accepts credentials via a URL parameter, according to ISC Sans, with a CVSS v3.1 Base Score of 9.8 and confirmed impact on multiple Hikvision IP camera and DVR models. Since initial discovery, honeypot logs recorded thousands of exploit attempts across multiple endpoints, and a summary shows total exploit attempts reaching 6,720 across several target URLs as of 23 September 2025.

Mitigation strategies include firmware updates from Hikvision, network segmentation, strong credentials, disabling URL-based logins, log monitoring for unexpected 200 OK responses, and restricting remote administration.