Summary
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code and upload malicious files to the affected device.
The following versions of H.VIEW HV-500S6 IP Camera are affected:
- H.VIEW HV-500S6 IP Camera IPCAM_V4.06.88.251229
| CVSS | Vendor | Equipment | Vulnerabilities |
|---|---|---|---|
| v3 7.2 | H.VIEW | H.VIEW HV-500S6 IP Camera | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’), Unrestricted Upload of File with Dangerous Type |
Background
- Critical Infrastructure Sectors: Commercial Facilities
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: China
Vulnerabilities
CVE-2026-55975
A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device’s certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.
Affected Products
H.VIEW HV-500S6 IP Camera
H.VIEW
H.VIEW H.VIEW HV-500S6 IP Camera: IPCAM_V4.06.88.251229
known_affected
Remediations
Mitigation
H.View did not respond to CISA’s request to coordinate. Users are encouraged to reach out to H.View for support. https://hviewsmart.com/pages/contact-us
https://hviewsmart.com/pages/contact-us
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
Metrics
| CVSS Version | Base Score | Base Severity | Vector String |
|---|---|---|---|
| 3.1 | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 4.0 | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVE-2026-56414
A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity or behavior even after reboot.
Affected Products
H.VIEW HV-500S6 IP Camera
H.VIEW
H.VIEW H.VIEW HV-500S6 IP Camera: IPCAM_V4.06.88.251229
known_affected
Remediations
Mitigation
H.View did not respond to CISA’s request to coordinate. Users are encouraged to reach out to H.View for support. https://hviewsmart.com/pages/contact-us
https://hviewsmart.com/pages/contact-us
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: