PT-2025-47019 · Planex · Planex Cs-Qp50F-Ing2

Todor Donev · Published 2025-11-14 · Updated 2025-11-15 · CVE-2021-4468

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PLANEX CS-QP50F-ING2 smart cameras (affected versions not specified)

Description The PLANEX CS-QP50F-ING2 smart cameras have a configuration backup interface accessible over HTTP without authentication. An unauthenticated remote attacker can retrieve a compressed configuration backup file directly from the device. This backup file contains sensitive configuration information, including credentials, potentially granting the attacker administrative access to the camera and compromising the monitored environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-4468

Affected Products

Planex Cs-Qp50F-Ing2

References · 7

• 🔥 https://packetstorm.news/files/id/160805 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2021010050 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4468 · Security Note
• https://t.me/CVEtracker/37380 · Telegram Post
• https://twitter.com/CVEnew/status/1989472532672442683 · Twitter Post
• https://vulncheck.com/advisories/planex-cs-qp50f-ing2-smart-camera-remote-configuration-disclosure · Note
• https://planex.co.jp/products/cs-qp50f · Note