Loading story…
A critical vulnerability was identified in CloudEdge online cameras and the associated app, allowing attackers to exploit improper neutralization of wildcards or matching symbols in MQTT topic inputs. The vulnerability, tracked as CVE-2025-11757, arises because the CloudEdge Cloud does not properly sanitize MQTT topic input, enabling an attacker to subscribe to a wildcard MQTT topic and receive messages intended for other users. Through this method, an attacker can intercept sensitive information, including credentials and key data necessary to connect to peer-to-peer cameras. The vulnerability is remotely exploitable and has been assigned a CVSS v4 base score of 8.7, indicating high severity. The affected product includes at least CloudEdge App version 4.4.2, with the potential for other versions or products to be impacted, though a comprehensive list of affected products is not yet available. The exploitation of this flaw could allow unauthorized access to live video feeds and camera controls, posing significant privacy and security risks to users worldwide. The vulnerability was reported by a researcher known as Ph4ng0t and disclosed through CISA and CVE advisories. CloudEdge and its parent company, Meari Technologies, have not responded to CISA's attempts at coordinated disclosure, and as of the latest advisories, no official mitigation or patch has been provided by the vendor. The vulnerability affects commercial facilities and is deployed globally, with the company headquartered in China. The lack of input sanitization in the MQTT protocol implementation is the core technical issue, making it possible for attackers to eavesdrop on communications and potentially compromise a large number of devices. The risk evaluation highlights that attackers could gain access to sensitive information, which could be used for further attacks or unauthorized surveillance. The advisories recommend that users remain vigilant and monitor for updates, but without vendor cooperation, users may need to consider additional network segmentation or device isolation as interim protective measures. The incident underscores the importance of secure MQTT implementation and the risks associated with hard-coded credentials and poor input validation in IoT devices. The vulnerability has drawn attention from both government and independent security researchers due to its potential impact on privacy and security. Organizations using CloudEdge products are advised to assess their exposure and consider alternative security controls until a vendor fix is available. The case also highlights ongoing challenges in coordinated vulnerability disclosure, especially with vendors that are unresponsive to security advisories.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the same 2025-10-21 advisory, CISA reported that CloudEdge and parent company Meari Technologies did not respond to coordination attempts. CISA also said it was not aware of any public exploitation specifically targeting the vulnerability at the time of publication.
On 2025-10-21, CISA published ICS Advisory ICSA-25-294-05 warning that CloudEdge App version 4.4.2 and associated CloudEdge Online Cameras are affected by CVE-2025-11757, an improper neutralization of MQTT wildcards vulnerability. The flaw could let an unauthenticated attacker subscribe to broad MQTT topics, exposing credentials and key material that could enable access to live video feeds and camera control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including network devices, workflow automation platforms, document management systems, and developer tools. Notable issues include command injection flaws in TRENDnet TEW-800MB routers (CVE-2025-15136, CVE-2025-15137), remote code execution vulnerabilities in Xspeeder SXZOS (CVE-2025-54322), Eigent (CVE-2025-68952), StreamVault (CVE-2025-66203), n8n (CVE-2025-68668), and Yealink T21P_E2 phones (CVE-2025-66738). Additional vulnerabilities involve authentication bypasses in IBM API Connect (CVE-2025-13915) and Eaton UPS Companion (CVE-2025-59887), a session token capture flaw in M-Files Server (CVE-2025-13008), prototype pollution in apidoc-core (CVE-2025-13158), and a blind SQL injection in Cloudlog (CVE-2024-44065). Several of these vulnerabilities allow for remote exploitation, with some exploits already publicly available. Vendors have responded with patches for many of the affected products, such as Eigent, StreamVault, lmdeploy, and n8n, while some issues remain with public exploits and no vendor response, as seen with TRENDnet. The vulnerabilities present risks ranging from arbitrary code execution and privilege escalation to unauthorized access and data exposure. Organizations using the affected products are strongly advised to review the relevant advisories, apply available patches, and implement recommended mitigations to reduce the risk of exploitation. The diversity and severity of these vulnerabilities underscore the importance of timely vulnerability management and monitoring for emerging threats across the software supply chain.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026
CISA added two high-severity vulnerabilities affecting specific **Milesight AIOT camera firmware** versions, exposing the devices through embedded secrets in the product. **`CVE-2026-27785`** is a **hard-coded credentials** flaw (`CWE-798`) that can allow unauthorized access without privileges or user interaction, with impact spanning confidentiality, integrity, and availability. The issue was listed with a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating attackers on an adjacent network could exploit the weakness to take control of affected cameras. CISA also published **`CVE-2026-32644`**, a **hard-coded cryptographic key** issue (`CWE-321`) tied to SSL certificates that use default private keys in Milesight camera firmware. That flaw carries a critical CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning it is remotely exploitable over the network and could enable full compromise of device communications and operations. The disclosures were accompanied by CISA advisory and CSAF references, as well as vendor firmware download links for affected Milesight products.
Jun 29, 2026