Loading story…
CISA disclosed CVE-2026-1241, an authentication bypass using an alternate path or channel affecting Pelco Sarix Professional (Sarix Pro) 3 Series IP cameras via the devices’ web management interface. The issue is attributed to inadequate access-control enforcement, enabling attackers to access certain functions without proper authentication, which can result in unauthorized viewing of live video streams and exposure of sensitive device data—creating privacy, operational, and potential regulatory/compliance risks for organizations using these cameras in monitored facilities.
Affected versions include Sarix Professional IMP 3, IXP 3, IBP 3, and IWP 3 series running firmware <= 02.52. CISA lists the vulnerability with CVSS v3 7.5 severity and notes broad deployment across multiple critical infrastructure sectors; the CVE record also maps the weakness to CWE-288 and includes a CVSS v4.0 vector indicating network-reachable, low-complexity exploitation with no privileges or user interaction required, while pointing back to the CISA ICS advisory as the primary reference.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for CVE-2026-1241 documented the authentication-bypass issue in Pelco Sarix Pro 3 Series IP cameras, noting network-reachable exploitation without privileges or user interaction. The record highlighted risks including unauthorized viewing of live video streams and referenced the CISA advisory for further details.
CISA released ICS advisory ICSA-26-057-02 for CVE-2026-1241, affecting Pelco Sarix Professional IMP, IXP, IBP, and IWP 3 Series cameras running firmware 02.52 or earlier. CISA rated the issue high severity, recommended network-segmentation and exposure-reduction measures, and said it had no reports of public exploitation at publication.
Souvik Kandar reported an authentication-bypass vulnerability affecting Pelco Sarix Pro 3 Series IP cameras to CISA. The flaw allows access to certain web management functions without authentication and could expose live video streams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
CISA published an ICS advisory for **CVE-2026-40624**, a critical flaw affecting multiple AVer PTC camera models, including the **PTC500S, PTC115, PTC500+, and PTC115+**. The vulnerability stems from improper input validation and can allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request. The issue is rated **Critical**, with a **CVSS v3.1 score of 9.8** and a **CVSS v4.0 score of 9.3**, and all listed versions of the affected products were reported as vulnerable. CISA said it had no reports of public exploitation targeting the flaw at the time of publication, but urged organizations to reduce internet exposure of control system devices, isolate affected networks, and use secure remote access methods such as fully updated VPNs. Additional mitigation guidance calls for updating camera firmware to the latest available version and applying vendor-provided security patches as they become available.
Jul 12, 2026