Camera CVE Watch
Every flaw in IP cameras, video recorders and the NAS boxes that store footage that CISA has confirmed exploited in the wild, ranked for patching with ransomware links, EPSS scores and CISA due dates.
For owners of cameras, recorders or a NAS holding footage. Hunting a hidden camera? Use the lens finder. Curated slice of KEV: a missing model has not been checked.
Loading the catalogue
Fetching the camera and recorder entries from CISA KEV, then EPSS trends from FIRST.
Loading…
How the camera CVE watch works
The pwnsy API at antispy.pwnsy.com reads the CISA Known Exploited Vulnerabilities catalogue from CISA's GitHub mirror, keeps the entries for cameras, recorders, surveillance platforms and footage storage, groups them by vendor and device family, and attaches each CVE's FIRST EPSS score. Your browser then asks FIRST for each CVE's percentile and its score 30 days ago, to draw the trend arrows. If FIRST does not answer, the table keeps the scores the API returned and says so under the table.
How the priority score works. Every row is already exploited in the wild (that is what KEV means). The score orders the patch queue: +3 ransomware use recorded by CISA, +2 EPSS 50% or higher (+1 for 10% to 50%), +1 added to KEV in the last 365 days. Range 0 to 6. The Patch first filter and the panel at the top show scores of 4 or more.
How to read the result
- EPSS is FIRST's estimate of exploitation in the next 30 days. The arrow compares today's score with 30 days ago. A low score on a KEV entry points to targeted use, so it never justifies skipping the patch.
- Due date. CISA's deadline for US federal agencies, a useful urgency marker for everyone else. Dates within a week, and dates already passed, are flagged in the row detail.
- Ransomware. "known use" means CISA records use of this flaw in ransomware campaigns.
What to do with a match. Open the row, follow the vendor advisory, compare against the firmware version on the device's admin page, update. Then remove internet exposure (port forwards, UPnP, unneeded cloud relays) and change the admin password. The camera exposure probe shows what your camera still answers from the internet.
Camera CVE FAQ
What is the CISA KEV catalogue?
The Known Exploited Vulnerabilities catalogue is CISA's list of flaws with confirmed exploitation in the wild. This page keeps the entries for IP cameras, video recorders, surveillance platforms and the NAS boxes that store footage.
How is the priority score calculated?
Each entry scores 3 points for ransomware use recorded by CISA, 2 points for EPSS at or above 50% or 1 point for 10% to 50%, and 1 point if it was added to KEV in the last 365 days. The range is 0 to 6, and the Patch first filter shows scores of 4 or more.
Why does a camera CVE with a low EPSS score still matter?
EPSS is FIRST's estimate of exploitation in the next 30 days. Every row here is already exploited in the wild, so a low score points to targeted use and never justifies skipping the patch.
Does the CISA due date apply to me?
The due date is CISA's deadline for US federal agencies. It is a useful urgency marker for everyone else.
My camera model is not listed. Is it safe?
Not necessarily. This is a curated slice of KEV, so a missing model has not been checked. Check the vendor advisory for your model and firmware.
Records from the CISA Known Exploited Vulnerabilities catalogue; EPSS scores, percentiles and 30-day trend from FIRST EPSS. Product matching, family grouping and the priority score are ours.