Security intelligence for video infrastructure
What is changing in the security of cameras, recorders and video-management platforms: newly published vulnerabilities, confirmed exploitation, and the vendor advisories that explain them. Sourced, dated, and revised in the open.
Advisories
A sudo bug is a camera bug: component vulnerabilities in video devices
CVE-2021-3156, the sudo heap overflow known as Baron Samedit, is recorded in NVD against the Synology VS960HD and has been in CISA's Known Exploited Vulnerabilities catalogue since April 2022 — catalogued under the vendor name "Sudo", where no camera owner is looking.
Three exploited D-Link flaws filed under "NAS" that resolve to NVR hardware
Two D-Link command-injection and hard-coded-credential flaws plus a Backup Config integrity failure (CWE-494) are in CISA's exploited catalogue; the KEV entries say "NAS" and "DNR-322L", but the CPE match names DNR-series network video recorders.
GeoVision end-of-life devices are being exploited and no patch is coming
Discontinued GeoVision IP cameras, video servers, LPR units and DVRs carry two unauthenticated OS command injection flaws that CISA records as exploited, and because the products are end-of-life there is no fix to apply.
Hikvision web server command injection, and the older auth bypass in the same estate
An unauthenticated command injection in the Hikvision camera web server, alongside a 2017 improper-authentication flaw in an overlapping product line; both are recorded by CISA as exploited.
Confirmed exploitation
Video-product vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue, most recently added first. 22 of the 1279 vulnerabilities we track are listed.
CVE-2017-7921 — Hikvision Multiple Products
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build…
CVE-2022-40799 — D-Link DNR-322L
Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the…
CVE-2020-25079 — D-Link DCS-2530L and DCS-2670L Devices
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command…
CVE-2020-25078 — D-Link DCS-2530L and DCS-2670L Devices
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password…
CVE-2023-38950 — ZKTeco BioTime
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was…
CVE-2024-11120 — GeoVision Multiple Devices
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on…
CVE-2024-6047 — GeoVision Multiple Devices
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute…
CVE-2025-1316 — Edimax IC-7100 IP Camera
Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the…
Recently published
CVE-2026-75619
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data…
CVE-2026-75618
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to…
CVE-2026-15316
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted…
CVE-2026-15315
Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in…
CVE-2026-13545
A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the…
CVE-2026-12760
A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated…
CVE-2026-12174
A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such…
CVE-2026-6250
An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a…
CVE-2026-11497
A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver.…
CVE-2026-8714
A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigger a…
CVE-2026-1871
TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by…
CVE-2026-35718
A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending…