PT-2026-28304 · Unknown · Lsc Indoor Camera

Published 2026-03-27 · Updated 2026-03-27 · CVE-2025-69986

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LSC Indoor Camera version 7.6.32

Description A buffer overflow issue exists in the ONVIF GetStreamUri function. The application does not properly check the length of the Protocol parameter within the Transport element. An attacker can exploit this by sending a crafted SOAP request with an oversized protocol string, leading to a stack buffer overflow and overwriting the return instruction pointer (RIP). This can result in a Denial of Service (DoS) through device crashes or potentially allow for Remote Code Execution (RCE) within the ONVIF service context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Stack Overflow

Weakness Enumeration

CWE-20

CWE-121

Related Identifiers

CVE-2025-69986

Affected Products

Lsc Indoor Camera

References · 3

• 🔥 https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/blob/main/CVE-2025-69986.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69986 · Security Note
• https://twitter.com/vuldb/status/2037542717341978688 · Twitter Post