Loading story…
A critical argument injection vulnerability, tracked as CVE-2025-12556, was identified in the IDIS ICM Viewer software. This flaw allows remote attackers to execute arbitrary code on affected systems by exploiting improper neutralization of argument delimiters in command execution. The vulnerability is rated with a CVSS v3.1 base score of 8.8 and a CVSS v4 score of 8.7, indicating high severity and significant risk to organizations using the affected product.
The vulnerability specifically impacts ICM Viewer version v1.6.0.10, and exploitation could compromise the host machine's security. IDIS has responded by requiring all users to upgrade to version v1.7.1 to mitigate the risk, warning that failure to update will render the software unusable. CISA has also issued an advisory urging immediate action, including uninstalling the program if it is not in use, to prevent potential exploitation in critical infrastructure environments worldwide.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-12556 was publicly listed as an argument injection vulnerability in IDIS ICM Viewer. The CVE publication provided a distinct identifier and classified the issue as high severity.
CISA released ICS advisory ICSA-25-308-05 covering a security issue affecting IDIS ICM Viewer. The advisory marks the public disclosure of the vulnerability affecting the product.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a **one-click remote code execution** path affecting the Windows-based **IDIS Cloud Manager (ICM) Viewer** used to monitor IDIS IP camera deployments. The issue is tracked as **CVE-2025-12556** (reported **CVSS 8.7**) and could allow an attacker to achieve **full compromise of the victim workstation** by luring a user into clicking a specially crafted link, effectively turning surveillance management tooling into an initial access vector for broader enterprise intrusion. Technical details indicate the attack chain involves a local Windows service, `CWGService.exe`, which listens on **localhost port 16140** and accepts commands (via a WebSocket interaction) to launch the ICM Viewer with supplied parameters. The service reportedly **does not adequately validate the origin of requests or sanitize input arguments**, enabling parameter injection that can lead to code execution on the host running ICM Viewer. The vulnerability was attributed to research by **Claroty/Team82**, and is relevant to organizations using IDIS’s cloud-managed surveillance ecosystem (cameras/NVRs/VMS integrated through ICM).
Jun 29, 2026
Dell disclosed **CVE-2026-67261**, a critical OS command injection flaw in **Dell Virtual Storage Integrator (VSI) for VMware vSphere Client** that affects versions prior to **10.11.1.0**. The vulnerability is located in the **IAPI** component and can be exploited **remotely without authentication**, allowing an attacker to execute arbitrary operating system commands with **root privileges**. The issue is tracked as **CWE-78** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a high likelihood of full compromise. Dell warned that successful exploitation could lead to complete takeover of the VSI deployment and potentially expose underlying infrastructure managed through the platform. A related advisory from **CERT-PY** highlighted the vulnerability in Dell products, reinforcing the need for defensive action. Dell has recommended that customers **upgrade to version 10.11.1.0 or later as soon as possible** to remediate the risk.
Aug 16, 2026
Cisco disclosed command injection and remote code execution vulnerabilities affecting **Cisco Integrated Management Controller (CIMC)**, warning that the flaws could allow an attacker to execute arbitrary commands or code on impacted systems. The advisory identifies the issue as affecting CIMC and frames it as a serious compromise path into server management infrastructure, where successful exploitation could give an attacker control over administrative functions and underlying devices. The vulnerabilities were published in a Cisco security advisory under the topic **"Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities."** Organizations using Cisco CIMC are expected to review the vendor advisory, determine whether exposed or internet-reachable management interfaces are affected, and apply Cisco-provided fixes or mitigations to reduce the risk of unauthorized command execution on management controllers.
Jun 29, 2026