Loading story…
A critical pre-authentication remote code execution vulnerability has been publicly disclosed in Vicon Valerus ViconNet Gateway version 25.200.46.0. The flaw affects the ASP.NET Web API endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start, where attacker-controlled input is concatenated into cmd.exe /c and launched through Process.Start, allowing arbitrary command execution. Researchers said the endpoint is reachable without authentication and bypasses an authorization gate, enabling remote attackers with network access to ports 8084 or 8444 to execute code as NT AUTHORITY\SYSTEM.
The advisory warns that successful exploitation can result in full compromise of the video management host, including access to recorded footage, camera credentials, and VMS configuration, as well as the ability to alter surveillance operations or destroy evidence. The issue was disclosed by the 0day Rubbish Research Team, which published both an advisory and a proof of concept, increasing the likelihood of near-term exploitation against exposed systems.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
0day Rubbish Research Team publicly disclosed a critical pre-authentication remote code execution vulnerability in Vicon Valerus ViconNet Gateway version 25.200.46.0. The advisory and proof of concept described an unauthenticated command injection in the OWIN Web API that could yield NT AUTHORITY\SYSTEM access.
The Vicon Valerus pre-authentication RCE disclosure appeared in the Full Disclosure mailing list archives, further publicizing the issue. The posting described the vulnerable endpoint and the risk of full host compromise affecting surveillance systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A publicly disclosed vulnerability in **vMix 29** (`29.0.0.48`) allows **pre-authentication remote code execution** through the product’s Web Controller on port `8088`. The flaw is exposed via the `GET /api/?Function=ScriptStartDynamic&Value=<VB.NET source>` endpoint, which compiles and runs attacker-supplied VB.NET code using `VBScriptProvider.Compile`. Although vMix attempts to prevent abuse with a six-item substring blocklist, researchers showed the generated compilation template includes `Imports System.Diagnostics`, enabling attackers to reach `Process.Start` without using blocked terms and bypass the intended restrictions. The issue is especially severe because the Web Controller defaults to a **blank password**, and vendor documentation indicates that a blank password means no login is required regardless of access settings, leaving the API reachable without authentication. Successful exploitation can deliver arbitrary OS command execution and arbitrary file read/write with the privileges of `vMix64.exe`, which is commonly run as an administrator account. The advisory rates the flaw **CVSS 9.8** and describes it as a critical exposure in a product that had not previously been assigned public CVEs.
Aug 6, 2026
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026