Active scans detected targeting Hikvision camera API endpoints

Mon, 20 Jul 2026 13:16:24 +0000

Engineer — Plan: If your environment includes Hikvision cameras, audit whether their Intelligent Security API is exposed to the internet and place them behind a firewall or VPN; no new CVE is cited but active scanning indicates exploitation interest.
SOC/IR — Plan: Add or tune detections for inbound probes against Hikvision API paths (e.g., /ISAPI/ endpoints) in perimeter logs; SANS honeypots are detecting active internet-wide scans worth tracking as a precursor to exploitation.
Leader — Skip

Cameras on CuraSec