Loading story…
Researchers reported a one-click remote code execution path affecting the Windows-based IDIS Cloud Manager (ICM) Viewer used to monitor IDIS IP camera deployments. The issue is tracked as CVE-2025-12556 (reported CVSS 8.7) and could allow an attacker to achieve full compromise of the victim workstation by luring a user into clicking a specially crafted link, effectively turning surveillance management tooling into an initial access vector for broader enterprise intrusion.
Technical details indicate the attack chain involves a local Windows service, CWGService.exe, which listens on localhost port 16140 and accepts commands (via a WebSocket interaction) to launch the ICM Viewer with supplied parameters. The service reportedly does not adequately validate the origin of requests or sanitize input arguments, enabling parameter injection that can lead to code execution on the host running ICM Viewer. The vulnerability was attributed to research by Claroty/Team82, and is relevant to organizations using IDIS’s cloud-managed surveillance ecosystem (cameras/NVRs/VMS integrated through ICM).
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CISA assigned or published guidance for CVE-2025-12556, rating it CVSS 8.7 and warning that the flaw could enable full compromise of affected Windows workstations. The agency advised users to upgrade to version 1.7.1 or remove the viewer if unnecessary.
Following confirmation of the flaw, IDIS told customers to upgrade ICM Viewer to version 1.7.1 or uninstall the software if upgrading was not possible. This guidance served as the vendor's mitigation and response to the vulnerability.
Claroty publicly released research showing how a malicious webpage could connect to CWGService.exe on localhost:16140 and inject Chromium flags such as --utility-cmd-prefix to achieve code execution on the host. The publication established the attack as a one-click client-side compromise path affecting ICM Viewer users.
Claroty Team82 identified a one-click remote code execution vulnerability in the Windows-based IDIS Cloud Manager Viewer caused by unsafe localhost WebSocket handling, a hard-coded key, and unsanitized Chromium/CEF arguments. The issue was disclosed to IDIS and confirmed by the vendor as CVE-2025-12556.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcereddit.com
Open sourceclaroty.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical argument injection vulnerability, tracked as CVE-2025-12556, was identified in the *IDIS ICM Viewer* software. This flaw allows remote attackers to execute arbitrary code on affected systems by exploiting improper neutralization of argument delimiters in command execution. The vulnerability is rated with a CVSS v3.1 base score of 8.8 and a CVSS v4 score of 8.7, indicating high severity and significant risk to organizations using the affected product. The vulnerability specifically impacts *ICM Viewer* version v1.6.0.10, and exploitation could compromise the host machine's security. IDIS has responded by requiring all users to upgrade to version v1.7.1 to mitigate the risk, warning that failure to update will render the software unusable. CISA has also issued an advisory urging immediate action, including uninstalling the program if it is not in use, to prevent potential exploitation in critical infrastructure environments worldwide.
Jul 12, 2026
Cisco disclosed command injection and remote code execution vulnerabilities affecting **Cisco Integrated Management Controller (CIMC)**, warning that the flaws could allow an attacker to execute arbitrary commands or code on impacted systems. The advisory identifies the issue as affecting CIMC and frames it as a serious compromise path into server management infrastructure, where successful exploitation could give an attacker control over administrative functions and underlying devices. The vulnerabilities were published in a Cisco security advisory under the topic **"Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities."** Organizations using Cisco CIMC are expected to review the vendor advisory, determine whether exposed or internet-reachable management interfaces are affected, and apply Cisco-provided fixes or mitigations to reduce the risk of unauthorized command execution on management controllers.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026