Which versions of Vacron VIN-DS783E-E6 are affected by CVE-2026-18191?

The Vacron VIN-DS783E-E6 network surveillance device is vulnerable to unauthenticated remote credential theft, enabling attackers to seize complete administrative control of surveillance…

How to fix or mitigate CVE-2026-18191?

Within 24 hours: Conduct a complete inventory of Vacron VIN-DS783E-E6 devices across your environment and immediately apply firewall rules to restrict network access to these devices from authorized monitoring stations only, blocking all external connectivity. Within 7 days: Implement network segmentation isolating the surveillance devices from corporate networks; rotate all device administrator credentials and capture baseline configurations for change detection; establish monitoring for unauthorized login attempts and suspicious API activity. Within 30 days: Contact Vacron directly regarding patch status and security timeline; if no patch becomes available within 30 days, initiate procurement for replacement surveillance devices from vendors with active security maintenance and establish a deprecation date for the affected hardware.

Vacron VIN-DS783E-E6 CVE-2026-18191

Q: What is the CVSS score of CVE-2026-18191?

CVE-2026-18191 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50163 CRITICAL

Hidden Functionality (CWE-912)

2026-07-29 twcert

GHSA-fpc8-2xhq-9939

Information Disclosure Vin Ds783E E6

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable hidden function (AV:N/AC:L/PR:N/UI:N); leaked admin credentials yield full device control, so C:H and consequential I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 08:15 vuln.today

CVE Published

Jul 29, 2026 - 06:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.

AnalysisAI

Credential exposure in the Vacron VIN-DS783E-E6 network video/surveillance device lets unauthenticated remote attackers invoke an undocumented hidden function that returns the device administrator credentials, per a TWCERT-coordinated disclosure. Recovering the admin login yields complete takeover of the appliance (login, configuration, and video streams). No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.

Technical ContextAI

The affected item (cpe:2.3:a:vacron:vin-ds783e-e6) is a Vacron-branded networked video/DVR-class surveillance appliance, a category typically running embedded Linux with a web/CGI management interface exposed over the network. The root cause is classified as CWE-912 (Hidden Functionality), meaning the firmware ships an undocumented, unintended code path - effectively a backdoor endpoint - that discloses stored administrator credentials. Because the function is reachable without authentication, the device's credential-storage and access-control model can be bypassed entirely by anyone who knows or discovers the hidden request.

RemediationAI

No vendor-released patch version is identified in the available data, so consult the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11049-db9ae-2.html and https://www.twcert.org.tw/tw/cp-132-11048-c8ce2-1.html) and Vacron for a firmware update and apply it once released. Until a fixed firmware is confirmed, remove the device from any internet exposure and place it on an isolated management VLAN reachable only by trusted hosts, since the hidden function requires network reachability - this blocks remote exploitation but limits legitimate remote administration. Restrict inbound access to the device's web/management port with a firewall ACL allowing only known operator IPs, and put the appliance behind a VPN for any remote access; because the leaked credentials are the built-in admin account, also change the administrator password after patching and monitor device logs for anomalous administrative logins, recognizing that a password change alone will not close a hidden-function backdoor that returns stored credentials.