Brickcom IP Cameras EUVD-2026-36309

Exploitation requires only HTTP reachability to the camera's /ONVIF endpoint on an affected Brickcom Cube, Dome, Bullet, or Box model - no credentials, no user interaction, and no special configuration on the camera (the missing authentication is the default behavior of the vulnerable firmware). The practical limiting factor is network reachability: cameras deployed on a properly segmented management VLAN with no inbound routing from user or internet zones are not exploitable from those zones, and CISA's classification of this as an ICS advisory implies many deployments are in OT networks where segmentation is the primary compensating control. The vendor CVSS marks AV:L, but the /ONVIF HTTP attack surface is network-layer in practice, so treat any L3-reachable camera as exposed.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:N, VC:H, SC:H/SI:H) yields 8.3 and emphasizes high confidentiality impact plus a subsequent-system confidentiality and integrity effect - consistent with surveillance footage feeding into broader monitoring/VMS infrastructure. However, AV:L (local) conflicts with the description's reference to an /ONVIF HTTP endpoint, which is typically network-reachable; this looks like a scoring inconsistency and defenders should treat exposure as network-reachable for any camera not strictly segmented. EPSS, KEV, and POC data are not provided, and no public exploit was identified at time of analysis, but the exploitation primitive (an unauthenticated HTTP GET) is so simple that internet-exposed devices should be considered high real-world risk regardless of EPSS. CISA ICS advisory ICSA-26-162-03 governs the disclosure and is the authoritative source.

An attacker on the same network segment as the camera (or on the internet, if the camera is exposed) sends an unauthenticated HTTP request to the camera's /ONVIF snapshot URI and receives a current JPEG of the camera's field of view, repeating the request to effectively reconstruct a low-frame-rate video feed. In a physical-security context this enables pre-attack reconnaissance of staffing patterns, access points, or sensitive areas; in an OT context it can leak views of control rooms or industrial processes. No exploit code is required beyond a curl command.