Which versions of H.View IP Camera are affected by CVE-2026-55975?

H.View HV-500S6 IP cameras contain a high-severity authenticated command injection vulnerability allowing any user with valid device credentials to execute arbitrary system commands with elevated…

How to fix or mitigate CVE-2026-55975?

Within 24 hours: Inventory all HV-500S6 units in production and audit active user accounts; immediately disable unnecessary credentials and implement detailed access logging on all remaining accounts. Within 7 days: Isolate all cameras to a dedicated, access-restricted VLAN with firewall rules limiting inbound connections to authorized monitoring stations only; disable WAN connectivity if operational requirements permit. Within 30 days: Initiate phased hardware replacement with alternative camera systems from vendors providing active security patch cadence; prioritize units deployed in critical security zones.

H.View IP Camera CVE-2026-55975

Q: What is the CVSS score of CVE-2026-55975?

CVE-2026-55975 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-39926 HIGH

OS Command Injection (CWE-78)

2026-06-26 icscert

GHSA-prhf-prrf-qvqw

Command Injection Hv 500S6 Ip Camera

8.6

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable certificate interface with low complexity but requires a high-privilege authenticated account (PR:H); injected OS command runs on the same device with full C/I/A impact, no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 23:30 vuln.today

CVSS changed

Jun 26, 2026 - 23:22 NVD

7.2 (HIGH) 8.6 (HIGH)

DescriptionCVE.org

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

AnalysisAI

Authenticated command injection in H.View HV-500S6 IP cameras allows a logged-in user to inject unsanitized XML field values into the device's certificate generation interface, which are passed into a backend certificate-creation shell command and executed with elevated privileges. Because exploitation requires valid credentials (CVSS 4.0 PR:H) but is reachable over the network with low complexity, an attacker who obtains any account on the device can run arbitrary OS commands and take full control of the camera. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic OS command injection (CWE-78): the camera firmware builds a shell command to generate an X.509 certificate and interpolates attacker-controlled XML fields (such as certificate subject attributes) directly into that command string without sanitization or argument separation. The affected platform per the supplied CPE is cpe:2.3:a:h.view:hv-500s6_ip_camera, an embedded Linux-based network/IP surveillance camera. Embedded camera firmware commonly invokes OpenSSL or similar tooling via system()/popen() calls, so shell metacharacters (;, |, $(), backticks) embedded in the XML reach the OS shell. The vendor advisory is coordinated through ICS-CERT (reporter 'icscert', CISA ICS advisory icsa-26-176-05), placing this in the operational-technology / physical-security device category rather than general IT software.

RemediationAI

No vendor-released patch version was identified in the supplied data; the references point to the CISA ICS advisory ICSA-26-176-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-05) and the H.View contact page (https://hviewsmart.com/pages/contact-us) rather than a tagged firmware release, so consult those for any updated firmware and apply it once available. As compensating controls: place the cameras on an isolated management VLAN and block their web/management interface from the internet and from general user networks (trade-off: remote viewing requires a VPN or jump host); replace default and shared credentials with strong unique passwords and restrict administrative accounts, since the flaw requires an authenticated high-privilege session (trade-off: tighter account management overhead); and avoid exposing or permitting use of the certificate-generation interface by non-trusted operators. Monitor device logs for unexpected certificate-generation activity or shell command patterns where available.