Which versions of Brickcom IP Cameras are affected by CVE-2026-50245?

Brickcom IP camera models (Cube, Dome, Bullet, Box) contain a critical access-control flaw enabling remote retrieval of live surveillance snapshots, exposing physical-security monitoring…

How to fix or mitigate CVE-2026-50245?

24 hours: Catalog all Brickcom camera deployments by model, document network IP addresses and ONVIF endpoint accessibility, and assess whether cameras are reachable from untrusted networks. 7 days: Implement firewall rules restricting ONVIF endpoint (ports 8080/8443) access to authorized administrative networks only; enable network logging for all ONVIF requests. 30 days: Monitor Brickcom security bulletins for firmware patches; verify patch compatibility with existing installations; evaluate vendor alternatives if remediation timeline exceeds risk tolerance.

Brickcom IP Cameras CVE-2026-50245

Q: What is the CVSS score of CVE-2026-50245?

CVE-2026-50245 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36309 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-11 icscert

GHSA-p643-w432-6q35

Authentication Bypass Cube Dome Bullet Box

8.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated HTTP GET to a network-reachable /ONVIF endpoint (AV:N, AC:L, PR:N, UI:N) discloses live surveillance imagery (C:H) without affecting integrity or availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:28 vuln.today

CVSS changed

Jun 11, 2026 - 21:22 NVD

7.7 (HIGH) 8.3 (HIGH)

DescriptionCVE.org

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.

AnalysisAI

Unauthenticated snapshot disclosure in Brickcom Cube, Dome, Bullet, and Box IP cameras lets anyone reachable on the camera's /ONVIF endpoint retrieve still images from the live video feed without credentials. The flaw, reported through CISA ICS-CERT (ICSA-26-162-03) and tagged as an authentication bypass, is a classic CWE-306 missing-authentication issue affecting devices typically deployed in physical-security and OT environments. No public exploit identified at time of analysis, but exploitation is trivial once the endpoint is reachable.

Technical ContextAI

ONVIF is the industry standard web-services profile used by IP cameras and VMS platforms for discovery, streaming, and snapshot retrieval over HTTP/SOAP, and its specification requires that media-retrieval methods such as GetSnapshotUri be protected by WS-Security or HTTP digest authentication. The CPE strings (cpe:2.3:a:brickcom:cube/dome/bullet/box) cover Brickcom's full lineup of indoor and outdoor surveillance form factors, indicating the defect lives in shared camera firmware rather than a single model. The root cause maps to CWE-306 (Missing Authentication for Critical Function): the /ONVIF handler serves the snapshot resource without invoking the authentication layer that ONVIF mandates, so an HTTP GET against the right URI returns a JPEG of whatever the camera currently sees.

RemediationAI

No vendor-released patch version is identified in the provided input - review Brickcom's advisory page (https://www.brickcom.com/case/) and CISA ICSA-26-162-03 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03) for the current firmware release covering this issue and upgrade affected Cube/Dome/Bullet/Box units accordingly. Until a firmware fix is confirmed and applied, place cameras on an isolated management VLAN and block inbound access to the /ONVIF HTTP endpoint from untrusted networks at the perimeter or upstream switch ACL - note this will also break legitimate ONVIF clients (NVR/VMS) that traverse those segments, so allowlist VMS source IPs explicitly. Avoid exposing camera HTTP/ONVIF ports to the internet under any circumstances, and audit existing exposure with Shodan or internal asset scans; if the camera supports disabling anonymous ONVIF discovery or forcing WS-Security, enable those settings, accepting that some older NVR integrations may need reconfiguration.