Vilar VS-IPC1002 CVE-2025-53702
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent LAN access to camera
-
ExploitCraft malicious request to /cgi-bin/action
-
ExecutionTrigger unhandled exception in handler
-
ImpactCamera becomes unresponsive, surveillance down
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling procedures
|
| Exploitation Conditions | Attacker must be on the same local/adjacent network segment as the camera (AV:A) and able to reach the device's web interface on the /cgi-bin/action CGI endpoint; no authentication, credentials, or user interaction are needed (PR:N/UI:N) and default configurations are affected. Confirmed only on firmware version 1.1.0.18. Primary limiting factor is the adjacent-network requirement - this cannot be triggered directly from the internet without first obtaining LAN access, and successful exploitation only crashes the device (requiring a manual restart) rather than yielding code execution or data access. |
| Impact | This is a genuine but geographically-contained availability threat, not a widespread emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an unauthenticated, low-complexity attack, but AV:A limits it to the adjacent/local network - an attacker must already be on the same LAN or Wi-Fi segment, which sharply reduces internet-scale exposure. Impact is purely availability (VA:H; VC:N/VI:N), consistent with CWE-755 (improper handling of an exceptional condition) causing a crash. All exploitation signals point to LOW real-world urgency: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit is identified. No SSVC decision was provided in the input. The signals are internally consistent - a moderate-severity local DoS. Two caveats: the input 'Information Disclosure' tag directly contradicts the vector (VC:N means no confidentiality impact), and the CPE lists vendor 'vimicro' while the description names vendor 'Vilar' - verify vendor identity before cataloguing. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the local network (e.g., a compromised device or rogue guest on the same Wi-Fi/LAN as the camera) sends a single crafted HTTP request to the camera's /cgi-bin/action endpoint. The device crashes and stays unresponsive, disabling video surveillance until someone physically power-cycles it. No authentication, user interaction, or public exploit is required, though no proof-of-concept is currently published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in Vilar VS-IPC1002 IP cameras (confirmed on firmware 1.1.0.18) allows an unauthenticated attacker located on the same local network segment to render the device completely unresponsive by sending a single crafted request to the /cgi-bin/action CGI endpoint; recovery requires a manual power cycle or restart. No credentials or user interaction are needed, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the adjacent-network prerequisite and high availability impact, while the CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no confidentiality or integrity loss. Exploitation is bounded to the LAN and there is no public exploit code identified at time of analysis, no CISA KEV listing, and a low EPSS score of 0.23% (13th percentile); the vendor did not respond to CERT.PL, so no vendor-released patch is identified at time of analysis. This is a genuine but geographically-contained availability threat, not a widespread emergency.
RemediationAI
No vendor-released patch was identified at time of analysis: CERT.PL reported the issue on behalf of cvd@cert.pl and the vendor did not respond in any way, so there is no fixed firmware version to upgrade to and users should not expect a supported fix; track https://cert.pl/en/posts/2025/10/CVE-2025-53701 for any later vendor response, and if a firmware update does appear, treat it as unverified until the DoS is retested against /cgi-bin/action. Because the attack requires same-segment access (AV:A) and no credentials, the highest-value compensating control is network isolation: place the cameras on a dedicated IoT/VLAN segment with strict ACLs so that only authorized management hosts (e.g., the NVR or admin workstation) can reach the device's HTTP interface, which blocks the crafted request from ordinary LAN users at the cost of losing flat-network convenience and requiring switch/firewall reconfiguration. Where the web UI is not needed for normal operation, disable or firewall the embedded HTTP server entirely (blocking external access to /cgi-bin/) and manage the camera only through the NVR or RTSP/ONVIF streams; the trade-off is loss of direct browser-based configuration and possible dependency on vendor tooling. Deploying a monitoring/watchdog that power-cycles or PoE-bounces the camera when it stops responding reduces outage duration but does not prevent the DoS, since a manual restart is otherwise required and the attacker can repeat the request. Given the vendor's silence, treat these cameras as end-of-support for security purposes and plan replacement or permanent segmentation rather than relying on a patch that may never arrive.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is an IP surveillance camera whose firmware is tracked as cpe:2.3:o:vimicro:vs-ipc1002_firmware:1.1.0.18 (note the CPE vendor string is 'vimicro', while the product is marketed as Vilar VS-IPC1002). The flaw is classified as CWE-755, Improper Handling of Exceptional Conditions, which in practice means the embedded web server's /cgi-bin/action CGI handler does not safely handle a malformed or unexpected request: rather than returning an error, the request path drives the process or its watchdog/event loop into a state from which it never recovers, taking the whole device offline until a human power-cycles it. Because the vulnerable code sits behind the camera's own management interface, the attack surface is the device's HTTP endpoint reachable from the local subnet rather than the internet, and the CVSS 4.0 vector's AV:A with PR:N/UI:N reflects exactly that shape: adjacent access, no authentication, no interaction. Notably, the supplied tag set labels this entry 'Information Disclosure', which is inconsistent with the reported and assessed impact (VC:N/VI:N/VA:H, availability-only); the tags should be treated as metadata noise rather than evidence of a confidentiality impact. Only firmware 1.1.0.18 was tested, so the true version spread is unknown, and because the vendor was unresponsive there is no upstream root-cause fix or hardening guidance available.
Know when Vs Ipc1002 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent LAN reach (AV:A), simple unauthenticated crafted request (AC:L/PR:N/UI:N), crash-only so C:N/I:N and A:H with unchanged scope.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
Executive ViewAI
Vilar VS-IPC1002 IP cameras running firmware 1.1.0.18 are vulnerable to an unauthenticated denial-of-service attack from within the same local network segment, which can render devices unresponsive and require manual power cycling. This affects physical security monitoring capabilities, potentially creating temporary surveillance blind spots for facilities relying on these cameras. While no public exploit code exists and exploitation is LAN-bound, no vendor-released patch identified at time of analysis means organizations must rely on network mitigations to protect these devices.
Implement strict network segmentation to isolate cameras on a dedicated VLAN, restrict access to the /cgi-bin/action endpoint via firewall rules, monitor network traffic for exploitation attempts, and ensure physical security to prevent unauthorized LAN access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB