Souvik Kandar

**Name of the Vulnerable Software and Affected Versions** KMW CCTV Security Cameras (affected versions not specified) **Description** An issue exists that allows an unauthenticated attacker to remotely reset the administrator password to a known value. This action grants full access to the camera settings and feeds. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ZKTeco CCTV cameras (affected versions not specified) **Description** An issue exists in ZKTeco CCTV cameras that allows unauthenticated users to export configuration data, which leads to the exposure of administrator credentials. **Recommendations** Update the firmware to the latest version.

**Name of the Vulnerable Software and Affected Versions** Milesight AIOT cameras (affected versions not specified) **Description** A weak key generation issue allows authorization to be bypassed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Milesight AIOT cameras (affected versions not specified) **Description** An out-of-bounds memory access issue exists in the firmware of Milesight AIOT cameras. This occurs when the software accesses memory outside the intended boundary of a buffer, which can lead to system instability or unauthorized actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Milesight cameras (affected versions not specified) **Description** A command injection flaw exists in the web server of the camera firmware. Command injection is a type of attack where an attacker can execute arbitrary operating system commands on the server by exploiting an application that improperly validates input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Milesight AIOT camera firmware (affected versions not specified) **Description** Specific firmware versions contain hard-coded credentials, which are usernames and passwords embedded directly into the software code by the developer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Milesight AIOT cameras (affected versions not specified) **Description** Specific firmware versions use SSL certificates with default private keys. SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Carlson VASCO-B GNSS Receiver (affected versions not specified) **Description** The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism. This allows an attacker with network access to directly access and modify its configuration and operational functions without credentials. There have been reports of attackers exploiting this flaw to gain unauthenticated access, escalate privileges, and move laterally through manufacturing networks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime segmentation to contain post-compromise activity in critical infrastructure.

**Name of the Vulnerable Software and Affected Versions** Anritsu Remote Spectrum Monitor (affected versions not specified) **Description** The Remote Spectrum Monitor is susceptible to an authentication bypass, enabling unauthorized access and manipulation of its management interface. The device lacks any authentication mechanism, making this a design flaw rather than a configuration issue. This allows for potential RF surveillance hijacking and signal manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nanoleaf Lines versions 12.3.2 through 12.3.5 **Description** Nanoleaf Lines does not properly authenticate firmware file uploads. This allows a remote, unauthenticated attacker to upload firmware files to the device, potentially consuming storage resources. **Recommendations** Update to version 12.3.6 or later.

**Name of the Vulnerable Software and Affected Versions** Labkotec LID-3300IP (affected versions not specified) **Description** The Labkotec LID-3300IP ice detector software contains a flaw that allows an unauthenticated attacker to modify device settings and execute commands by sending crafted network packets to the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pelco Sarix Professional 3 Series Cameras (affected versions not specified) **Description** The Pelco Sarix Professional 3 Series Cameras have a flaw in their web management interface related to insufficient access control enforcement. This allows access to certain functionality without proper authentication. Successful exploitation could lead to unauthorized viewing of live video streams, potentially causing privacy concerns and operational risks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Honeywell CCTV products versions prior to firmware updates addressing CVE-2026-1670 Honeywell I-HIB2PI-UL 2MP IP (6.1.22.1216) Honeywell SMB NDAA MVO-3, PTZ WDR 2MP 32M, 25M IPC (WDR 2MP 32M PTZ v2.0) **Description** The affected products are vulnerable to an unauthenticated API endpoint exposure. This allows an attacker to remotely change the "forgot password" recovery email address, potentially leading to full account takeover and unauthorized access to camera feeds. The issue is rated as critical with a CVSS score of 9.8. The vulnerability impacts systems deployed in commercial, industrial, and critical infrastructure environments globally. The vulnerable API endpoint does not require authentication, enabling an attacker to modify the email address associated with password recovery. This allows the attacker to initiate a password reset and gain control of the account. The `recovery email` is the key parameter exploited through the exposed API endpoint. **Recommendations** Apply firmware updates addressing CVE-2026-1670 as soon as they become available. Remove internet exposure for affected cameras. Segment affected cameras on a network to limit access. Enforce secure remote access to affected cameras. As a temporary workaround, consider restricting access to the vulnerable API endpoint.

**Name of the Vulnerable Software and Affected Versions** Avation Light Engine Pro (affected versions not specified) **Description** Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control, granting attackers full control over critical lighting infrastructure. The interface allows complete configuration and control without requiring any credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOMA Seismic Station versions v2.4.2520 and prior **Description** The MOMA Seismic Station web management interface does not require authentication. This allows an unauthenticated attacker to modify configuration settings, obtain device data, or remotely reset the device. The issue poses a risk of complete remote takeover of the device. **Recommendations** Versions prior to v2.4.2520 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Synectix LAN 232 TRIO versions (affected versions not specified) **Description** The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter’s web management interface is accessible without authentication. This allows unauthenticated users to modify critical device settings or perform a factory reset. The vulnerability enables trivial remote takeover of serial-to-Ethernet infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sharp Display Solutions Media Player MP-01 (affected versions not specified) **Description** A critical issue exists in Sharp Display Solutions Media Player MP-01 where a missing authentication check for a critical function allows unauthorized access to the web interface. This access enables an attacker to modify settings and perform operations on the device. Additionally, content can be delivered from authoring software to the affected product without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Güralp Fortimus Series Güralp Minimus Series Güralp Certimus Series (affected versions not specified) **Description** A flaw exists in the web interface of Güralp Fortimus, Minimus, and Certimus Series devices. An unauthenticated attacker with network access can send crafted HTTP requests, causing the web service process to restart. This results in a temporary denial-of-service condition during the restart process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CCTV (affected versions not specified) **Description** A malicious actor can access camera configuration information, including account credentials, without authentication by accessing a vulnerable URL. This flaw potentially risks video feed hijack and credential theft. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Iskra iHUB and iHUB Lite (affected versions not specified) **Description** The Iskra iHUB and iHUB Lite smart metering gateway’s web management interface is accessible without authentication. This allows unauthenticated users to access and modify critical device settings. The gateway exposes its admin panel with no authentication required, potentially enabling network pivoting into critical infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.