Critical KMW CCTV Vulnerability (CVE-2026-5386) Allows Remote Attackers to Hijack Camera Feeds
By
Abinaya
Hot, fresh, and worth queueing round the block for.
Summary
A critical security vulnerability (CVE-2026-5386) has been discovered in KMW CCTV security cameras, carrying a CVSS v3 score of 9.1. The flaw involves an "unverified password change" weakness that allows remote attackers to modify authentication credentials without proper validation, potentially giving them full unauthorized access to live camera feeds and device settings. This poses a severe risk to organizations that rely on these surveillance systems for security monitoring.
Key quotes
· 4 pulledA critical security flaw in KMW CCTV security cameras could allow attackers to gain full, unauthorized access to live camera feeds and device settings.
The vulnerability, tracked as CVE-2026-5386, has been assigned a high CVSS v3 score of 9.1, highlighting its severe impact on organizations relying on these surveillance systems.
The issue stems from an 'unverified password change' weakness in affected devices, which allows remote attackers to modify authentication credentials without proper validation.
Once exploited, threat actors can take control of the camera, view real-time video
You might also wanna read
Critical Redis Security Vulnerability CVE-2025-49844 Allows Remote Code Execution
Redis has identified and fixed a critical security vulnerability (CVE-2025-49844) that allows authenticated users to execute remote code thr
redis.io·8mo ago
Critical Redis Vulnerability (CVE-2025-49844) Allows Remote Code Execution with Maximum CVSS Score
Wiz Research has discovered a critical remote code execution vulnerability (CVE-2025-49844, nicknamed #RediShell) in Redis, the widely used
wiz.io·8mo ago
Critical Security Vulnerability CVE-2025-66478 in React Server Components Protocol
A critical security vulnerability (CVE-2025-66478) has been discovered in the React Server Components (RSC) protocol with a CVSS score of 10
nextjs.org·6mo ago
Critical Security Vulnerability in React Server Components (CVE-2025-55182) Allows Remote Code Execution
The React team disclosed a critical security vulnerability (CVE-2025-55182) rated CVSS 10.0 that allows unauthenticated remote code executio
react.dev·6mo ago
Critical RCE vulnerability CVE-2026-3854 discovered in GitHub's internal git infrastructure
Wiz Research discovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure affecting both GitHub.com and GitHu
Wiz.io·1mo ago
Critical Authentication Bypass Vulnerability Discovered in cPanel & WHM (CVE-2026-41940)
watchTowr Labs reports on a critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM, a widely-used web hosting control
watchTowr Labs·1mo ago