Vilar VS-IPC1002 CVE-2025-53701

Exploitation requires (1) a logged-in VS-IPC1002 administrator with an active authenticated session, (2) that admin being induced to open an attacker-crafted GET request to the /cgi-bin/action endpoint whose parameters are reflected without sanitization (UI:A - active user interaction is mandatory), and (3) typically adjacent-network positioning (AV:A), consistent with these cameras being deployed on LANs rather than exposed to the Internet. Because the flaw is reflected (non-persistent) rather than stored, there is no standing payload - each exploitation depends on a fresh social-engineering delivery to an authenticated admin. Confirmed only on firmware 1.1.0.18; no vendor patch is available. Risk increases materially if the camera's web interface is reachable from the Internet.

This is a genuinely low-to-moderate priority issue despite being a CRITICAL-sounding 'remote code in browser' class flaw. Multiple signals agree it is NOT an urgent threat: the CVSS 4.0 base score is only 4.8 (Medium), driven by low impacts (VC:N/VI:N/VA:N on the vulnerable system; only subsequent-system SC:L/SI:L reflecting the admin browser/session), adjacent attack vector (AV:A, not full Internet reach), and required user interaction (UI:A). EPSS reinforces this with a low 0.22% exploitation probability (11th percentile). There is no CISA KEV listing and no public exploit code identified, so this is not actively exploited. The main limiting factor is that this is a REFLECTED (non-persistent) XSS requiring an authenticated admin to be socially engineered into clicking an attacker-crafted link, and the attacker must typically be positioned on the adjacent network (AV:A) since IP cameras are usually LAN-deployed. One point to verify: reflected web XSS is often scored AV:N, but CERT.pl assigned AV:A - this is a defensible choice for a LAN-only camera, though it means risk rises if the device is exposed to the Internet. Also note the vendor did not respond and only firmware 1.1.0.18 was tested, so no patch exists and the affected-version range is unconfirmed.

An attacker on the same network segment as the camera crafts a malicious URL targeting the /cgi-bin/action endpoint with unsanitized parameters and sends it to a logged-in administrator (e.g., via chat or email). When the admin opens the link, the injected JavaScript executes in their authenticated browser session, letting the attacker perform actions as the admin or steal session context. No public exploit code was identified at time of analysis.