Loading story…
Cognex has confirmed that nearly a dozen serious security vulnerabilities affecting its IS2000M-120 industrial smart cameras will not be patched, citing the product's age as the primary reason. Security researchers from Nozomi Networks identified nine distinct flaws during a comprehensive assessment of the IS2000M-120, a device widely used in manufacturing environments for tasks such as part inspection, presence detection, and barcode reading. The vulnerabilities could allow attackers to fully compromise the affected cameras, potentially leading to significant operational disruptions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a public advisory on September 18, warning that exploitation of these flaws could halt production lines, damage equipment, or compromise safety-critical processes, even though the cameras themselves do not store sensitive data or serve as core network infrastructure. The research highlighted that the In-Sight Explorer platform, which is used to configure and manage these cameras, is particularly susceptible. Attackers on the same network could exploit weaknesses in the In-Sight protocol to intercept and reuse encrypted credentials, bypassing authentication controls. All three protocols used by the camera for authentication share the same flawed method, increasing the risk of unauthorized access. Despite the IS2000M-120 still being commercially available, Cognex has indicated it is considering end-of-life status for the device and is encouraging customers to purchase newer models instead of providing a security update. This decision has raised concerns among industrial operators who rely on these cameras for automation and quality control. The lack of a patch leaves organizations with limited mitigation options, primarily involving network segmentation and device isolation to reduce exposure. Security experts warn that unpatched vulnerabilities in operational technology can have cascading effects on industrial processes, especially when devices are deeply integrated into production environments. The incident underscores the ongoing challenge of securing legacy industrial devices that remain in active use but are no longer supported by vendors. CISA and Nozomi Networks both recommend that affected organizations assess their risk posture and consider replacing vulnerable devices as soon as feasible. The situation highlights the importance of lifecycle management and vendor support commitments in industrial cybersecurity planning. Organizations are urged to review their asset inventories and prioritize remediation or replacement of unsupported devices. The case also serves as a reminder that even devices not directly handling sensitive data can pose significant operational risks if compromised. Industrial security teams should remain vigilant for advisories related to legacy equipment and proactively engage with vendors regarding support timelines. The Cognex IS2000M-120 vulnerabilities exemplify the broader issue of unpatched legacy systems in critical infrastructure sectors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cognex stated it does not plan to develop patches for the IS2000M-120 vulnerabilities, describing the model as too old and considering it for end-of-life status despite it still being commercially available. This left mitigations such as network isolation as the primary defensive measure.
On 2025-09-18, CISA warned that exploitation of the Cognex camera flaws could disrupt manufacturing automation, halt production lines, damage equipment, or affect safety-critical processes. The agency recommended isolating the devices from the internet and using firewall and VPN protections.
Nozomi Networks found nine serious flaws affecting the Cognex IS2000M-120 industrial smart camera and the associated In-Sight Explorer management platform. The issues could enable credential replay, privilege escalation, tampering with backup jobs, and potentially full device compromise.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has published an advisory detailing several critical vulnerabilities in Cognex In-Sight Explorer and In-Sight Camera Firmware, affecting versions up to 6.5.1. The flaws include hard-coded passwords, cleartext transmission of sensitive information, improper permission assignments, and authentication bypasses, with CVSS v4 scores up to 8.6. Successful exploitation could allow attackers to steal credentials, modify device settings, or cause denial-of-service conditions.
Jun 29, 2026
An authentication bypass vulnerability, tracked as CVE-2025-10538, has been identified in LG Innotek camera models LND7210 and LNV7210R. This flaw allows remote attackers to gain unauthorized access to sensitive camera information, including user account details. The vulnerability is rated as high severity, with a CVSS v4 score of 8.8, indicating significant risk if exploited. Both affected camera models are widely deployed in commercial facilities and are used globally, increasing the potential impact of this security issue. The vulnerability can be exploited remotely and requires low attack complexity, meaning attackers do not need advanced skills or physical access to compromise the devices. Successful exploitation could grant an attacker administrative access, enabling them to manipulate camera settings, access video feeds, or harvest user credentials. The vulnerability is categorized under CWE-288, which involves authentication bypass using an alternate path or channel. All versions of the LND7210 and LNV7210R models are affected, and there are no unaffected versions available. The issue was reported to CISA by security researcher Souvik Kandar, highlighting the importance of coordinated vulnerability disclosure. LG Innotek has acknowledged the vulnerability but has stated that these camera models are end-of-life products and will not receive security patches. As a result, organizations using these cameras are advised to consider device replacement or network segmentation to mitigate risk. The vulnerability's presence in end-of-life products underscores the ongoing security challenges posed by legacy devices in critical infrastructure environments. CISA has issued an advisory to inform stakeholders and recommend mitigation strategies. The widespread deployment of these cameras in commercial sectors and their unpatchable status elevate the urgency for asset owners to take immediate action. Organizations should review their inventories for affected models and implement compensating controls where possible. The disclosure of this vulnerability serves as a reminder of the risks associated with unsupported hardware in operational environments. Security teams are encouraged to monitor for signs of exploitation and to prioritize the decommissioning of vulnerable devices. The incident highlights the need for proactive lifecycle management and regular security assessments of connected devices.
Jun 29, 2026
CISA released a coordinated set of advisories detailing newly discovered vulnerabilities affecting a range of industrial control system (ICS) products from vendors including Advantech, Johnson Controls, Mitsubishi Electric, and SolisCloud. The vulnerabilities include a critical SQL injection flaw in Advantech iView (CVE-2025-13373), improper certificate expiration validation in Johnson Controls iSTAR (CVE-2025-61736), cleartext storage of sensitive information in Mitsubishi Electric GX Works2 (CVE-2025-3784), a forced browsing vulnerability in Johnson Controls OpenBlue Mobile Web Application (CVE-2025-26381), and an authorization bypass in SolisCloud Monitoring Platform (CVE-2025-13932). These flaws could allow attackers to access or modify sensitive data, disrupt communications, or gain unauthorized access to critical infrastructure systems. CISA's advisories provide technical details, affected product versions, and recommended mitigations, such as software updates and network segmentation, to reduce the risk of exploitation. The vulnerabilities impact products deployed globally across sectors such as critical manufacturing, energy, commercial facilities, and government services. Some advisories note that fixes are available, while others indicate that patches are still under development or that vendors have not responded to coordination efforts. CISA urges organizations using these products to review the advisories and implement recommended mitigations to protect against potential attacks targeting these ICS environments.
Jun 29, 2026