Axis actively patches vulnerabilities. But many organizations treat surveillance cameras as "set and forget." Devices running firmware from 2015 still answer to indexframe.shtml queries today.
Place all video servers on an isolated VLAN with no direct internet access. If remote viewing is needed, require a VPN connection. Do not use port forwarding on your firewall. inurl indexframe shtml axis video server top
One might think, "So what if someone sees my parking lot camera?" The implications are far more severe than a privacy breach. Axis actively patches vulnerabilities