Loading story…
An authentication bypass vulnerability, tracked as CVE-2025-10538, has been identified in LG Innotek camera models LND7210 and LNV7210R. This flaw allows remote attackers to gain unauthorized access to sensitive camera information, including user account details. The vulnerability is rated as high severity, with a CVSS v4 score of 8.8, indicating significant risk if exploited. Both affected camera models are widely deployed in commercial facilities and are used globally, increasing the potential impact of this security issue. The vulnerability can be exploited remotely and requires low attack complexity, meaning attackers do not need advanced skills or physical access to compromise the devices. Successful exploitation could grant an attacker administrative access, enabling them to manipulate camera settings, access video feeds, or harvest user credentials. The vulnerability is categorized under CWE-288, which involves authentication bypass using an alternate path or channel. All versions of the LND7210 and LNV7210R models are affected, and there are no unaffected versions available. The issue was reported to CISA by security researcher Souvik Kandar, highlighting the importance of coordinated vulnerability disclosure. LG Innotek has acknowledged the vulnerability but has stated that these camera models are end-of-life products and will not receive security patches. As a result, organizations using these cameras are advised to consider device replacement or network segmentation to mitigate risk. The vulnerability's presence in end-of-life products underscores the ongoing security challenges posed by legacy devices in critical infrastructure environments. CISA has issued an advisory to inform stakeholders and recommend mitigation strategies. The widespread deployment of these cameras in commercial sectors and their unpatchable status elevate the urgency for asset owners to take immediate action. Organizations should review their inventories for affected models and implement compensating controls where possible. The disclosure of this vulnerability serves as a reminder of the risks associated with unsupported hardware in operational environments. Security teams are encouraged to monitor for signs of exploitation and to prioritize the decommissioning of vulnerable devices. The incident highlights the need for proactive lifecycle management and regular security assessments of connected devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-10538, an authentication bypass vulnerability affecting LG Innotek cameras, was publicly listed by CVE tracking sources as a high-severity issue. This represents public cataloging of a specific vulnerability associated with the broader LG Innotek camera disclosures.
CISA released ICS advisory ICSA-25-273-07 covering multiple vulnerabilities affecting multiple LG Innotek camera models. The advisory marks the public disclosure of the issue set affecting these devices.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
CISA released a set of six Industrial Control Systems (ICS) advisories, highlighting multiple vulnerabilities in widely used industrial and surveillance products. Among these, the Automated Logic WebCTRL Premium Server and Carrier i-Vu platforms were found to be susceptible to open redirect and cross-site scripting vulnerabilities, which could allow remote attackers to redirect users to malicious websites or execute unauthorized scripts. The open redirect issue, tracked as CVE-2024-8527, affects several versions of both Automated Logic WebCTRL and Carrier i-Vu, with a high CVSS score indicating significant risk if exploited. Additionally, CISA detailed critical vulnerabilities in ICAM365 CCTV camera models P201 and QC021, specifically missing authentication for critical functions. These flaws could enable attackers to gain unauthorized access to camera video streams and configuration data via unauthenticated ONVIF and RTSP services. Both advisories urge administrators to review technical details and apply recommended mitigations to reduce the risk of exploitation in operational environments.
Jun 29, 2026