Loading story…
CISA released advisories detailing critical vulnerabilities affecting the Festo LX Appliance and multiple India-based CCTV cameras. The Festo LX Appliance was found to have a cross-site scripting (XSS) vulnerability (CVE-2021-23414) in versions prior to June 2023, which could allow a high-privilege user to craft a malicious course and execute arbitrary code via improper input neutralization in the video.js package. Festo coordinated the disclosure with CERT@VDE and recommends updating affected appliances to the latest version by contacting their services department. This vulnerability impacts sectors such as commercial facilities, communications, critical manufacturing, and energy worldwide.
Separately, a missing authentication vulnerability (CVE-2025-13607) was identified in D-Link (India) CCTV camera model DCS-F5614-L1 (versions v1.03.038 and prior), with similar issues suspected in Sparsh Securitech and Securus CCTV products. This flaw allows remote attackers to access camera configuration information, including account credentials, without authentication, posing a significant risk of information disclosure. The affected products are primarily deployed in India, and while D-Link is headquartered in Taiwan, the other vendors are based in India. Securus CCTV and Sparsh Securitech did not respond to CISA's coordination requests, and users are urged to review the advisories for mitigation steps.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA announced three Industrial Control Systems advisories covering U-Boot, Festo LX Appliance, and multiple India-based CCTV cameras. The advisories provided technical details and mitigation guidance for the identified vulnerabilities.
CISA published advisory ICSA-25-343-03 disclosing CVE-2025-13607 in multiple India-based CCTV cameras and recommending mitigations such as reducing network exposure and securing remote access. CISA noted no public exploitation had been reported at the time of release, and that Sparsh Securitech and Securus CCTV had not responded to coordination requests.
D-Link issued a security advisory and software update for the DCS-F5614-L1 camera model to address CVE-2025-13607. The issue affects version 1.03.038 and prior and was rated critical.
Souvik Kandar reported a critical missing-authentication vulnerability, later assigned CVE-2025-13607, affecting multiple India-based CCTV cameras to CISA. The flaw allows unauthenticated access to camera configuration data, including account credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026
CISA published multiple ICS advisories warning of high-severity vulnerabilities affecting industrial/IoT products deployed in critical infrastructure environments. For **Jinan USR IOT Technology (PUSR) USR-W610** (<= `3.1.1.0`), CISA reported multiple issues (including **CVE-2026-25715**, **CVE-2026-24455**, **CVE-2026-26049**, **CVE-2026-26048**) that could allow authentication to be effectively disabled (e.g., permitting blank admin credentials over the web interface and Telnet), enable credential exposure (including administrator credentials), and cause denial-of-service; one of the cited conditions results in full administrative control for a network-adjacent attacker without valid credentials (CVSS v3.1 **9.8**). Separately, **EnOcean SmartServer IoT** (<= `4.60.009`) was reported vulnerable to **OS command execution** via crafted LON IP-852 management messages (**CVE-2026-20761**) and an additional weakness that could leak memory and help bypass mitigations such as ASLR (**CVE-2026-22885**) (CVSS v3.1 **8.1**). CISA also warned that **Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller** is affected by **CVE-2026-24790** (**missing authentication for a critical function**), where the underlying PLC can be remotely influenced without proper safeguards, creating risk of **over- or under-odorization events** (CVSS v3.1 **8.2**). In parallel reporting, a separate CISA warning covered **Honeywell CCTV** products impacted by **CVE-2026-1670** (CVSS **9.8**), where an unauthenticated API endpoint could allow an attacker to change the “forgot password” recovery email and take over accounts to access camera feeds; at the time of reporting, there were no public exploitation reports, and CISA recommended reducing exposure (e.g., isolating devices behind firewalls and using secure remote access).
Jun 29, 2026