The vulnerability of D-Link DCS-960L IP camera’s microprogramming software allows a intruder to execute arbitrary code by bypassing the authentication process using an alternative path or channel.

The vulnerability of D-Link DCS-960L IP camera software relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-50777

The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera version V1.00.02 contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including Wi-Fi credentials and ONVIF service...

Critical Dahua Camera Flaws Enable Remote Hijack via ONVIF and File Upload Exploits

Cybersecurity researchers have disclosed now-patched critical security flaws in the firmware of Dahua smart cameras that, if left unaddressed, could allow attackers to hijack control of susceptible devices. "The flaws, affecting the device's ONVIF protocol and file upload handlers, allow...

CVE-2025-43217

The issue was addressed by adding additional logic. This issue is fixed in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6. Privacy Indicators for microphone or camera access may not be correctly displayed...

CVE-2025-43217

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed...

(Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sonia module. The issue results from the lack of...

PT-2025-31439 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera affected versions not specified Description: The Lorex 2K Indoor Wi-Fi Security Camera is susceptible to a stack-based buffer overflow, potentially leading to remote code execution. This issue was...

(Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests sent to TCP port 9876. The...

CVE-2025-50777

The CVE-2025-50777 entry concerns the AZIOT 2MP Full HD Smart Wi‑Fi CCTV Home Security Camera (firmware V1.00.02). The issue is an Incorrect Access Control vulnerability that allows local attackers to gain a root shell. Once exploited, attackers can access and exfiltrate sensitive data, including...

PT-2025-31445 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera affected versions not specified Description: The Lorex 2K Indoor Wi-Fi Security Camera contains an improper validation of array index flaw that can lead to remote code execution. The issue was discovered...

AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera 安全漏洞

AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera is an indoor smart surveillance device from AZIOT India. A security vulnerability exists in AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera version V1.00.02, which stems from improper access control and could lead to a local attacker...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iPadOS versions prior to 17.7.9, prior to 18.6, and Apple iOS versions prior to...

Aver PTC310UV2 安全漏洞

The AVer PTC310UV2 is an automatic tracking camera from AVer Corporation. A security vulnerability exists in the Aver PTC310UV2 version v.0.1.0000.59, which originates from a specially crafted request and could lead to the acquisition of sensitive information...

(Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sonia module. The issue results from the lack of...

CVE-2025-43217

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed...

CVE-2025-43217

CVE-2025-43217 affects Apple iPadOS and iOS where privacy indicators for microphone or camera access may not be correctly displayed. The issue is mitigated by Apple in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6 through added logic changes. CVSSv3.1 metrics indicate a Local attack vector, Low confide...

PT-2025-31301

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.6 iPadOS versions prior to 17.7.9 iPadOS versions prior to 18.6 Description Privacy Indicators for microphone or camera access may not be correctly displayed. The issue was addressed by adding additional logic...

A week in security (July 21 – July 27)

A list of topics we covered in the week of July 21 to July 27 of 2025 Last week on Malwarebytes Labs: Steam games abused to deliver malware once again Watch out: Instagram users targeted in novel phishing campaign Age verification: Child protection or privacy risk? iPhone vs. Android: iPhone user...

PT-2025-33783

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A stack buffer overflow exists in the gmin get var int function when handling EFI variables larger than 64 bytes. The gmin get config var function does not properly return error codes...

PT-2025-32444 · Trendnet +1 · Trendnet Tv-Ip110Wn +1

Name of the Vulnerable Software and Affected Versions: TRENDnet TV-IP110WN version 1.2.2 Description: A vulnerability exists in TRENDnet TV-IP110WN version 1.2.2 related to an unknown functionality of the file /server/boa.conf within the Embedded Boa Web Server component. This issue results in a...