Loading vulnerability…
Unauthenticated RCE in Longwatch devices via exposed HTTP endpoint
CVE-2025-13658 is a critical code injection / remote code execution vulnerability affecting Industrial Video & Control Longwatch devices, reported to impact versions 6.309 through 6.334. The flaw allows an unauthenticated attacker to send crafted HTTP GET requests to an exposed endpoint and trigger arbitrary code execution. The issue is attributed to the absence of code signing and execution controls, allowing untrusted code to be executed through the reachable web interface. Successful exploitation results in execution in the context of the target device with SYSTEM-level privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can achieve arbitrary code execution on affected Longwatch devices over the network with no user interaction and low attack complexity. Because exploitation yields SYSTEM-level privileges, the attacker can fully compromise the device, including modifying system state, accessing or altering data, disrupting service availability, and using the device as a foothold for further operations within OT or adjacent networks. Available scoring information indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to Longwatch management and web interfaces, especially from untrusted or internet-reachable networks. Place affected systems behind firewalls, segment them from business and external networks, and allow access only from dedicated administration hosts. Disable or tightly control remote access paths, use VPN-mediated access where required, and monitor HTTP requests to exposed endpoints for anomalous unauthenticated GET activity. CISA guidance also supports minimizing internet exposure and performing impact assessments before operational changes in ICS environments.
Patch, then assume compromise.
Industrial Video & Control recommends upgrading Longwatch to version 6.335 or later. Affected deployments running versions 6.309 through 6.334 should be prioritized for immediate upgrade. Organizations should also review the associated CISA ICS advisory ICSA-25-336-01 for vendor and operational guidance.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.