CISA Advisories on Festo LX Appliance and India-Based CCTV Camera Vulnerabilities

CISA released advisories detailing critical vulnerabilities affecting the Festo LX Appliance and multiple India-based CCTV cameras. The Festo LX Appliance was found to have a cross-site scripting (XSS) vulnerability (CVE-2021-23414) in versions prior to June 2023, which could allow a high-privilege user to craft a malicious course and execute arbitrary code via improper input neutralization in the video.js package. Festo coordinated the disclosure with CERT@VDE and recommends updating affected appliances to the latest version by contacting their services department. This vulnerability impacts sectors such as commercial facilities, communications, critical manufacturing, and energy worldwide.

Separately, a missing authentication vulnerability (CVE-2025-13607) was identified in D-Link (India) CCTV camera model DCS-F5614-L1 (versions v1.03.038 and prior), with similar issues suspected in Sparsh Securitech and Securus CCTV products. This flaw allows remote attackers to access camera configuration information, including account credentials, without authentication, posing a significant risk of information disclosure. The affected products are primarily deployed in India, and while D-Link is headquartered in Taiwan, the other vendors are based in India. Securus CCTV and Sparsh Securitech did not respond to CISA's coordination requests, and users are urged to review the advisories for mitigation steps.