Loading story…
CISA issued multiple ICS advisories covering Brickcom cameras, the Yarbo mobile app and cloud MQTT infrastructure, and the Naxclow IoT Platform, warning that weak authentication, default credentials, and hard-coded secrets could expose connected devices to takeover and surveillance. The Brickcom advisory said affected Cube, Dome, Bullet, and Box cameras running version 3.2.3.5.6 allow unauthenticated access to live snapshots through the /ONVIF endpoint and may ship with default credentials that permit administrative control and silent viewing of camera feeds. In Yarbo’s case, hard-coded MQTT broker credentials embedded in Android and iOS apps, combined with missing cloud authorization checks, could let attackers access telemetry from the global robot fleet and potentially issue commands to any robot using only its serial number.
CISA also detailed multiple vulnerabilities across all versions of Naxclow products including the Smart Doorbell X3, X Smart Home, V720, and ix cam, where authorization bypasses, predictable device identifiers, exposed relay credentials, and an exposed UART console could enable impersonation, fleet enumeration, interception of communications, and theft of Wi-Fi credentials. The most severe Naxclow issue, CVE-2026-28742, stems from a hard-coded platform-wide salt used for request signing and carries a CVSS 9.8 rating because a secret extracted from one device could be used to forge requests across the platform. Reporting indicates Naxclow had not responded and no official patch was available, while CISA said it had no evidence of public exploitation for any of the disclosed issues and urged organizations to reduce internet exposure, segment networks, and use secure remote access controls.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-16, SecurityOnline reported that CISA's Naxclow disclosure covered seven vulnerabilities affecting all versions of four product lines and said Naxclow had not responded, leaving no official patch available. The report highlighted risks including device takeover, video interception, and Wi-Fi credential theft.
On 2026-06-11, CISA published an advisory describing two high-severity vulnerabilities in Brickcom Cube, Dome, Bullet, and Box cameras running version 3.2.3.5.6. The issues involve missing authentication and default credentials that could allow unauthenticated access to live snapshots and administrative control; CISA also noted proof-of-concept material and no known public exploitation at publication.
On 2026-06-11, CISA published an advisory on multiple vulnerabilities affecting the Naxclow IoT Platform and associated products, including authorization bypass, hard-coded cryptographic material, predictable identifiers, and exposed UART access. CISA said Temuri Takalandze reported the vulnerabilities and that no known public exploitation had been reported at the time of publication.
On 2026-06-11, CISA published an advisory covering critical vulnerabilities in the Yarbo Android/iOS mobile application and cloud MQTT infrastructure, including hard-coded broker credentials and missing authorization controls. CISA said Markus Lassfolk of Truesec reported the issues and that no known public exploitation had been reported at the time of publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published multiple ICS advisories warning of high-severity vulnerabilities affecting industrial/IoT products deployed in critical infrastructure environments. For **Jinan USR IOT Technology (PUSR) USR-W610** (<= `3.1.1.0`), CISA reported multiple issues (including **CVE-2026-25715**, **CVE-2026-24455**, **CVE-2026-26049**, **CVE-2026-26048**) that could allow authentication to be effectively disabled (e.g., permitting blank admin credentials over the web interface and Telnet), enable credential exposure (including administrator credentials), and cause denial-of-service; one of the cited conditions results in full administrative control for a network-adjacent attacker without valid credentials (CVSS v3.1 **9.8**). Separately, **EnOcean SmartServer IoT** (<= `4.60.009`) was reported vulnerable to **OS command execution** via crafted LON IP-852 management messages (**CVE-2026-20761**) and an additional weakness that could leak memory and help bypass mitigations such as ASLR (**CVE-2026-22885**) (CVSS v3.1 **8.1**). CISA also warned that **Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller** is affected by **CVE-2026-24790** (**missing authentication for a critical function**), where the underlying PLC can be remotely influenced without proper safeguards, creating risk of **over- or under-odorization events** (CVSS v3.1 **8.2**). In parallel reporting, a separate CISA warning covered **Honeywell CCTV** products impacted by **CVE-2026-1670** (CVSS **9.8**), where an unauthenticated API endpoint could allow an attacker to change the “forgot password” recovery email and take over accounts to access camera feeds; at the time of reporting, there were no public exploitation reports, and CISA recommended reducing exposure (e.g., isolating devices behind firewalls and using secure remote access).
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026
CISA added two high-severity vulnerabilities affecting specific **Milesight AIOT camera firmware** versions, exposing the devices through embedded secrets in the product. **`CVE-2026-27785`** is a **hard-coded credentials** flaw (`CWE-798`) that can allow unauthorized access without privileges or user interaction, with impact spanning confidentiality, integrity, and availability. The issue was listed with a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating attackers on an adjacent network could exploit the weakness to take control of affected cameras. CISA also published **`CVE-2026-32644`**, a **hard-coded cryptographic key** issue (`CWE-321`) tied to SSL certificates that use default private keys in Milesight camera firmware. That flaw carries a critical CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning it is remotely exploitable over the network and could enable full compromise of device communications and operations. The disclosures were accompanied by CISA advisory and CSAF references, as well as vendor firmware download links for affected Milesight products.
Jun 29, 2026