EUVD-2026-39927
GHSA-65q4-rvjr-c9r5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin upload with no user interaction (AV:N/AC:L/UI:N) but requires high-privilege auth (PR:H); core impact is file/certificate integrity (I:H) with possible service disruption (A:L) and no clear data disclosure (C:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity or behavior even after reboot.
AnalysisAI
Arbitrary file upload in H.View HV-500S6 IP cameras lets an authenticated, high-privilege user (per CVSS PR:H) write unvalidated content to fixed, persistent filesystem paths reserved for trusted TLS certificate material, with no checks on file type, structure, or size. Because the planted data survives reboot, an attacker can corrupt or replace certificate stores to undermine device integrity, availability, and trust. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but it is the subject of a CISA ICS advisory (ICSA-26-176-05).
Technical ContextAI
The flaw is a CWE-434 (Unrestricted Upload of File with Dangerous Type) weakness in the camera's certificate-management upload interfaces. IP cameras such as the H.View HV-500S6 (cpe:2.3:a:h.view:hv-500s6_ip_camera) expose web/HTTP endpoints for administrators to upload TLS/SSL certificates and keys used for the device's HTTPS and RTSP-over-TLS services. The vulnerable design treats these endpoints as trusted: the uploaded payload is written verbatim to a fixed, known path on the embedded Linux filesystem (the location reserved for legitimate certificate material) without validating MIME/type, PEM/DER structure, or size. As a result the file slot intended for cryptographically trusted data can be filled with attacker-chosen bytes that persist across reboots, breaking the integrity assumptions the rest of the firmware places on that path.
RemediationAI
No vendor-released patch version was identified at time of analysis; the only vendor reference is a contact page (https://hviewsmart.com/pages/contact-us), so consult CISA advisory ICSA-26-176-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-05) and contact H.View for updated firmware before deploying. Because exploitation requires an authenticated high-privilege session, the most effective compensating controls are: remove the camera's management interface from any internet exposure and place it on an isolated VLAN reachable only by trusted management hosts (trade-off: legitimate remote admin must go through a VPN/jump host); change all default and shared administrative credentials and enforce unique strong passwords per device (trade-off: operational password management overhead); and restrict or firewall the HTTP/HTTPS admin and certificate-upload endpoints to a small allowlist of source IPs (trade-off: breaks ad-hoc remote configuration). After any suspected compromise, re-flash firmware and re-provision certificates, since planted files persist across reboot.
More in Hv 500S6 Ip Camera
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today