PT-2025-30693 · Lg Innotek · Lnv5110R

Published 2025-07-24 · Updated 2025-08-29 · CVE-2025-7742

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LG Innotek camera model LNV5110R

Description An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the device’s non-volatile storage. This action may result in remote code execution, allowing an attacker to run arbitrary commands on the target device at the administrator privilege level. Approximately 1,300 cameras are active and vulnerable worldwide. The manufacturer, LG Innotek, is aware of the vulnerability but will not patch it because this camera model is an end-of-life product.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2025-09276

CVE-2025-7742

Affected Products

Lnv5110R

References · 9

• https://bdu.fstec.ru/vul/2025-09276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7742 · Security Note
• https://twitter.com/TweetThreatNews/status/1948698931270910206 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1mexdyf/top_cybersecurity_stories_for_the_week_of_072825 · Reddit Post
• https://twitter.com/0dayPublishing/status/1948420228620128719 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-205-04 · Note
• https://twitter.com/HackerMigh32064/status/1948469380486234559 · Twitter Post
• https://twitter.com/CVEnew/status/1948531821416783897 · Twitter Post
• https://twitter.com/SecAideInfo/status/1949413394894962808 · Twitter Post