Which versions of Vacron VIN-DS783E-E6 are affected by CVE-2026-18192?

The Vacron VIN-DS783E-E6 network camera device contains a path traversal vulnerability (CVE-2026-18192, CVSS 7.1) that allows low-privilege authenticated users to download arbitrary files, including…

How to fix or mitigate CVE-2026-18192?

Within 24 hours: Inventory all Vacron VIN-DS783E-E6 devices across your environment and identify which are network-accessible or cloud-connected; document current user credentials and privilege levels for each device. Within 7 days: Implement network segmentation to restrict device access to trusted networks only, disable remote management interfaces if not operationally required, enforce strong unique credentials on all accounts with device access, and audit recent access logs for suspicious file download activity. Within 30 days: Contact Vacron support to request patch status and timeline; if patch unavailable, develop a device replacement schedule or establish a formal compensating-control verification process with documented risk acceptance from business stakeholders.

Vacron VIN-DS783E-E6 CVE-2026-18192

Q: What is the CVSS score of CVE-2026-18192?

CVE-2026-18192 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50164 HIGH

Relative Path Traversal (CWE-23)

2026-07-29 twcert

GHSA-28gh-7mch-gmg8

Path Traversal Vin Ds783E E6

7.1

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remotely reachable web endpoint with low complexity but requires a low-privilege authenticated account (PR:L); arbitrary file read yields high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 08:15 vuln.today

CVE Published

Jul 29, 2026 - 06:40 cve.org

HIGH 7.1

DescriptionCVE.org

VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

AnalysisAI

Arbitrary file read in the Vacron VIN-DS783E-E6 device allows authenticated remote attackers to download arbitrary files from the underlying system by abusing relative path traversal (CWE-23). Any user with valid low-privilege credentials can escape the intended file-serving directory and retrieve sensitive system files such as configuration, credential, or password stores. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.1 reflects network reachability, low attack complexity, and high confidentiality impact without integrity or availability effects.

Technical ContextAI

The affected product (CPE cpe:2.3:a:vacron:vin-ds783e-e6) is a Vacron networked surveillance/video appliance, a class of embedded Linux-based devices where a web management interface serves files to authenticated operators. The root cause is CWE-23 (Relative Path Traversal): a file-download or file-serving endpoint incorporates user-supplied input into a filesystem path without canonicalizing or constraining it, so sequences such as '../' walk out of the intended web/media root into the device's system directories. Because embedded appliances typically run the web service with elevated OS privileges, traversal to files like /etc/passwd, service configuration, or stored credentials is generally possible once the boundary is crossed.

RemediationAI

No vendor-released patch version is identified in the provided data, so consult the Vacron/TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11049-db9ae-2.html and https://www.twcert.org.tw/tw/cp-132-11048-c8ce2-1.html) for firmware updates and apply the fixed firmware as soon as it is published. Until a patch is confirmed, restrict network reachability of the device's management interface: place the appliance on an isolated VLAN or behind a firewall so the web service is not exposed to untrusted networks or the internet (trade-off: remote management must then go through a VPN/jump host). Because exploitation requires authentication, immediately change any default or shared credentials and enforce strong unique passwords per operator, and limit accounts to the minimum needed, since this directly raises the PR:L barrier the attack depends on. If feasible, place a reverse proxy or WAF in front of the interface to normalize paths and block '../' traversal sequences (trade-off: may break legitimate file-download features and requires tuning).