Loading story…
A critical vulnerability (CVE-2025-12108) has been identified in Survision License Plate Recognition (LPR) Cameras, where the system does not enforce password protection by default. This flaw allows anyone to access the configuration wizard without a login prompt or credentials, enabling full system access without authentication. The vulnerability is remotely exploitable, has a CVSS v4 score of 9.3, and affects all versions of the Survision LPR Camera prior to the release of a patched firmware.
The issue was reported by Souvik Kandar of Microsec and confirmed by both CISA and independent vulnerability databases. Survision has released firmware version v3.5 to address the vulnerability and recommends that users update their devices and enable configuration password protection. The affected cameras are deployed worldwide, including in critical infrastructure sectors, and the vendor is headquartered in France. Organizations using these cameras are urged to apply the firmware update and review their authentication settings to mitigate the risk of unauthorized access.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published ICS advisory ICSA-25-308-02 covering the Survision License Plate Recognition Camera vulnerability. The advisory formalized public reporting of the issue in an industrial control systems context.
A high-severity vulnerability, CVE-2025-12108, was publicly disclosed affecting Survision License Plate Recognition Camera products. The issue was described as missing authentication for a critical function.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026
An authentication bypass vulnerability, tracked as CVE-2025-10538, has been identified in LG Innotek camera models LND7210 and LNV7210R. This flaw allows remote attackers to gain unauthorized access to sensitive camera information, including user account details. The vulnerability is rated as high severity, with a CVSS v4 score of 8.8, indicating significant risk if exploited. Both affected camera models are widely deployed in commercial facilities and are used globally, increasing the potential impact of this security issue. The vulnerability can be exploited remotely and requires low attack complexity, meaning attackers do not need advanced skills or physical access to compromise the devices. Successful exploitation could grant an attacker administrative access, enabling them to manipulate camera settings, access video feeds, or harvest user credentials. The vulnerability is categorized under CWE-288, which involves authentication bypass using an alternate path or channel. All versions of the LND7210 and LNV7210R models are affected, and there are no unaffected versions available. The issue was reported to CISA by security researcher Souvik Kandar, highlighting the importance of coordinated vulnerability disclosure. LG Innotek has acknowledged the vulnerability but has stated that these camera models are end-of-life products and will not receive security patches. As a result, organizations using these cameras are advised to consider device replacement or network segmentation to mitigate risk. The vulnerability's presence in end-of-life products underscores the ongoing security challenges posed by legacy devices in critical infrastructure environments. CISA has issued an advisory to inform stakeholders and recommend mitigation strategies. The widespread deployment of these cameras in commercial sectors and their unpatchable status elevate the urgency for asset owners to take immediate action. Organizations should review their inventories for affected models and implement compensating controls where possible. The disclosure of this vulnerability serves as a reminder of the risks associated with unsupported hardware in operational environments. Security teams are encouraged to monitor for signs of exploitation and to prioritize the decommissioning of vulnerable devices. The incident highlights the need for proactive lifecycle management and regular security assessments of connected devices.
Jun 29, 2026
A critical vulnerability in KMW CCTV cameras, tracked as **CVE-2026-5386**, allows unauthenticated remote attackers to reset administrator passwords and seize control of affected devices. The flaw, described as an improper password-change verification weakness and rated **CVSS 9.1**, affects the **KM-IP521** and **KM-IP421** models, including firmware versions `IPCAM_V4.04.91.230307` and `IPCAM_V4.04.53.210416`. Successful exploitation can expose live video feeds, change device settings, disable surveillance functions, and alter logs to hide malicious activity. KMW has released patched firmware for the affected cameras, although the update for the **KM-IP421** temporarily removes cloud authorization functionality. CISA identified the issue in advisory **ICSA-26-148-06** and urged organizations to treat internet-exposed cameras as a high-priority risk, particularly in sectors including government, finance, transportation, manufacturing, and commercial facilities. No active exploitation has been confirmed, but defenders were advised to apply firmware updates immediately, keep surveillance devices off the public internet, isolate them behind firewalls or segmented networks, and limit remote access to secure VPN connections.
Jun 29, 2026