CVE-2017-7921-EXPLOIT

CVE-2017-7921 - Hikvision カメラシリーズにおける不適切な認証の脆弱性 CVE-2017-7921 として識別されるセキュリティ上の欠陥で、Hikvision カメラのさまざまなモデルに影響を与えます。この脆弱性は、DS-2CD2xx2F-I シリーズ（V5.2.0 build 140721 から V5.4.0 build 160530）、DS-2CD2xx0F-I シリーズ（V5.2.0 build 140721 から V5.4.0 Build 160401）、DS-2CD2xx2FWD シリーズ（V5.3.1 build 150410 から V5.4.4...

CVE-2026-84403

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-82585

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other...

CVE-2026-75558

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password a...

CVE-2026-88761

The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing an...

EUVD-2026-86454

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-77967 Botslab G980H Dashcams Authentication Bypass by Capture-replay

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...

anyka-ak3918-gt111a-root-decloud

📷 Anyka AK3918E GT111A Wi-Fi PTZ Camera — Root & De-Cloud...

CVE-2026-81630: Insufficient Verification of Data Authenticity

The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably...

CVE-2026-88761: Use of Weak Credentials

The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing an...

CVE-2026-88956: Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-85496: Generation of Predictable Numbers or Identifiers

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session...

PT-2026-98266

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

PT-2026-98265

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing...

CVE-2026-84399: Incorrect Authorization

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

CVE-2026-75608

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608

Frigate , an open-source network video recorder, had an authorization flaw in its nginx configuration (file docker/main/rootfs/usr/local/nginx/conf/nginx.conf). Prior to 0.18.0 , the prefix-matched location /api/go2rtc/api required authentication but did not enforce an administrator role for GET ...

CVE-2026-81321

CareCam CM2507 IP cameras store configured wireless network credentials (network identifier and pre-shared key) in cleartext within the device filesystem. An attacker who obtains filesystem access—through physical access, a debugging interface, or another vulnerability—can recover these credentia...

CVE-2026-81321 CareCam CM2507 Cleartext Storage of Sensitive Information

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

CVE-2026-84400

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of...