Loading story…
CISA has published an advisory detailing several critical vulnerabilities in Cognex In-Sight Explorer and In-Sight Camera Firmware, affecting versions up to 6.5.1. The flaws include hard-coded passwords, cleartext transmission of sensitive information, improper permission assignments, and authentication bypasses, with CVSS v4 scores up to 8.6. Successful exploitation could allow attackers to steal credentials, modify device settings, or cause denial-of-service conditions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
8 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cognex has confirmed that nearly a dozen serious security vulnerabilities affecting its IS2000M-120 industrial smart cameras will not be patched, citing the product's age as the primary reason. Security researchers from Nozomi Networks identified nine distinct flaws during a comprehensive assessment of the IS2000M-120, a device widely used in manufacturing environments for tasks such as part inspection, presence detection, and barcode reading. The vulnerabilities could allow attackers to fully compromise the affected cameras, potentially leading to significant operational disruptions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a public advisory on September 18, warning that exploitation of these flaws could halt production lines, damage equipment, or compromise safety-critical processes, even though the cameras themselves do not store sensitive data or serve as core network infrastructure. The research highlighted that the In-Sight Explorer platform, which is used to configure and manage these cameras, is particularly susceptible. Attackers on the same network could exploit weaknesses in the In-Sight protocol to intercept and reuse encrypted credentials, bypassing authentication controls. All three protocols used by the camera for authentication share the same flawed method, increasing the risk of unauthorized access. Despite the IS2000M-120 still being commercially available, Cognex has indicated it is considering end-of-life status for the device and is encouraging customers to purchase newer models instead of providing a security update. This decision has raised concerns among industrial operators who rely on these cameras for automation and quality control. The lack of a patch leaves organizations with limited mitigation options, primarily involving network segmentation and device isolation to reduce exposure. Security experts warn that unpatched vulnerabilities in operational technology can have cascading effects on industrial processes, especially when devices are deeply integrated into production environments. The incident underscores the ongoing challenge of securing legacy industrial devices that remain in active use but are no longer supported by vendors. CISA and Nozomi Networks both recommend that affected organizations assess their risk posture and consider replacing vulnerable devices as soon as feasible. The situation highlights the importance of lifecycle management and vendor support commitments in industrial cybersecurity planning. Organizations are urged to review their asset inventories and prioritize remediation or replacement of unsupported devices. The case also serves as a reminder that even devices not directly handling sensitive data can pose significant operational risks if compromised. Industrial security teams should remain vigilant for advisories related to legacy equipment and proactively engage with vendors regarding support timelines. The Cognex IS2000M-120 vulnerabilities exemplify the broader issue of unpatched legacy systems in critical infrastructure sectors.
Jun 29, 2026
CISA added two high-severity vulnerabilities affecting specific **Milesight AIOT camera firmware** versions, exposing the devices through embedded secrets in the product. **`CVE-2026-27785`** is a **hard-coded credentials** flaw (`CWE-798`) that can allow unauthorized access without privileges or user interaction, with impact spanning confidentiality, integrity, and availability. The issue was listed with a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating attackers on an adjacent network could exploit the weakness to take control of affected cameras. CISA also published **`CVE-2026-32644`**, a **hard-coded cryptographic key** issue (`CWE-321`) tied to SSL certificates that use default private keys in Milesight camera firmware. That flaw carries a critical CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning it is remotely exploitable over the network and could enable full compromise of device communications and operations. The disclosures were accompanied by CISA advisory and CSAF references, as well as vendor firmware download links for affected Milesight products.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026