Loading story…
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions.
Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA issued an alert for CVE-2025-13607 and advised organizations to patch affected devices, isolate them on networks, and restrict access. The guidance emphasized the risk to surveillance infrastructure despite no active exploitation being reported.
D-Link released a security update for the DCS-F5614-L1 camera model to address CVE-2025-13607. Other named vendors, including Sparsh Securitech and Securus CCTV, had not responded to coordination requests at the time of reporting.
Public proof-of-concept exploit code for CVE-2025-13607 was observed on GitHub, increasing the likelihood of exploitation. The references do not provide a more specific date than the disclosure timeframe.
A critical missing-authentication vulnerability, CVE-2025-13607, was disclosed affecting camera/CCTV products and enabling unauthenticated access to configuration data, video feeds, and account credentials. The issue was published by ICS-CERT/DHS and rated critical, with CVSS scores around 9.3-9.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released advisories detailing critical vulnerabilities affecting the Festo LX Appliance and multiple India-based CCTV cameras. The Festo LX Appliance was found to have a cross-site scripting (XSS) vulnerability (CVE-2021-23414) in versions prior to June 2023, which could allow a high-privilege user to craft a malicious course and execute arbitrary code via improper input neutralization in the `video.js` package. Festo coordinated the disclosure with CERT@VDE and recommends updating affected appliances to the latest version by contacting their services department. This vulnerability impacts sectors such as commercial facilities, communications, critical manufacturing, and energy worldwide. Separately, a missing authentication vulnerability (CVE-2025-13607) was identified in D-Link (India) CCTV camera model DCS-F5614-L1 (versions v1.03.038 and prior), with similar issues suspected in Sparsh Securitech and Securus CCTV products. This flaw allows remote attackers to access camera configuration information, including account credentials, without authentication, posing a significant risk of information disclosure. The affected products are primarily deployed in India, and while D-Link is headquartered in Taiwan, the other vendors are based in India. Securus CCTV and Sparsh Securitech did not respond to CISA's coordination requests, and users are urged to review the advisories for mitigation steps.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026
Bitdefender disclosed two serious vulnerabilities in Dahua camera firmware, tracked as **CVE-2025-31700** and **CVE-2025-31701**, that can be exploited by an unauthenticated attacker to achieve remote code execution or trigger denial of service. The flaws affect the **Dahua Hero C1 Smart Camera** and multiple Dahua **IPC, SD, and TPC** camera series, with all firmware released before `2025-04-16` reported as vulnerable. Both vulnerabilities carry a **CVSS 3.1 score of 8.1**, and CSIRT.SK warned that successful exploitation could compromise device integrity and the security of monitored premises. Administrators and camera owners were urged to apply Dahua’s available firmware updates promptly to reduce the risk of takeover or service disruption across exposed surveillance deployments.
Jul 24, 2026