All CISA Advisories, EN

Industrial Video & Control Longwatch

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.3
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Industrial Video & Control
  • Equipment: Longwatch
  • Vulnerability: IMPROPER CONTROL OF GENERATION OF CODE (‘CODE INJECTION’)

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthenticated attacker to gain remote code execution with elevated privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Industrial Video & Control Longwatch, a video surveillance and monitoring system, are affected:

  • Longwatch: Versions 6.309 to 6.334

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER CONTROL OF GENERATION OF CODE (‘CODE INJECTION’) CWE-94

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

CVE-2025-13658 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-13658. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND