Brickcom IP Cameras CVE-2026-50005

The attacker must reach the camera's management interface (HTTP/HTTPS web UI, ONVIF, or RTSP service) on a Brickcom Cube, Dome, Bullet, or Box camera where the operator has not changed the factory-shipped default credentials - the description states 'unauthenticated remote' access, which conflicts with the CVSS 4.0 AV:L metric and should be verified against the CISA advisory. Limiting factors: cameras deployed behind NAT or on isolated surveillance VLANs with no external port forwarding are not reachable from the internet, and operators who hardened the device by changing the default account at install time are not exploitable; no user interaction or privileges are required beyond knowledge of the documented default credentials.

The CVSS 4.0 vector AV:L/AC:L/PR:N/UI:N with VC:H plus subsequent-system SC:H/SI:H yields an 8.3 (High) score, but the AV:L (local) attack vector is internally inconsistent with the description's claim of 'unauthenticated remote attacker' access - typical default-credential flaws in network-exposed cameras warrant AV:N, so defenders should treat the practical attack surface as network-reachable wherever the camera's management interface is exposed. No EPSS score, KEV listing, or public POC is recorded in the supplied data, so this is currently no public exploit identified at time of analysis, but default-credential issues on internet-exposed cameras are routinely abused by botnets (Mirai-class) and surveillance scrapers (Shodan, search engines indexing open camera feeds), so real-world risk on any device reachable from untrusted networks is high. The SSVC-relevant signals (automatable=yes given a known default, technical impact=total over the video subsystem) reinforce treating exposed devices as priority remediation despite the absence of formal KEV/EPSS data.

An attacker enumerates internet-exposed Brickcom cameras via Shodan or similar device search engines, then submits the well-known factory default username and password to the camera's web or ONVIF interface. Authentication succeeds silently with no lockout or alert, and the attacker streams live RTSP video, downloads recordings, and potentially pivots into the surveillance VLAN; no public POC is required because the credentials themselves are the exploit.