Which versions of Brickcom IP Cameras are affected by EUVD-2026-36310?

Brickcom IP cameras (Cube, Dome, Bullet, Box lines) are shipped with unchanged factory-default credentials that allow attackers with network access to authenticate and view live surveillance feeds…

How to fix or mitigate EUVD-2026-36310?

Within 24 hours: Change default credentials on all Brickcom cameras to strong unique passwords and restrict management interface access to trusted networks only. Within 7 days: Verify credential changes across all deployed units, implement VLAN segmentation to isolate cameras from general network access, and review authentication logs for unauthorized login attempts. Within 30 days: Request updated firmware or patch availability from Brickcom, evaluate product replacement timeline if patch remains unavailable, and implement supplemental physical monitoring controls.

Brickcom IP Cameras EUVD-2026-36310

Q: What is the CVSS score of EUVD-2026-36310?

EUVD-2026-36310 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-50005 HIGH

Use of Default Credentials (CWE-1392)

2026-06-11 icscert

GHSA-4qgh-qg2j-6vjw

Information Disclosure Cube Dome Bullet Box

8.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Default credentials on a network-exposed camera management interface allow unauthenticated remote login (AV:N/PR:N/UI:N) yielding full video confidentiality loss; integrity/availability impact not stated in description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:28 vuln.today

CVSS changed

Jun 11, 2026 - 21:22 NVD

7.7 (HIGH) 8.3 (HIGH)

DescriptionCVE.org

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.

AnalysisAI

Unauthorized camera feed access affects Brickcom Cube, Dome, Bullet, and Box IP camera product lines due to factory-shipped default credentials (CWE-1392). Any attacker reaching the camera's management interface can authenticate using the known default account and silently view live video, with no public exploit identified at time of analysis though the trivial nature of the issue means weaponization requires no specialized tooling. CISA ICS-CERT issued advisory ICSA-26-162-03 covering the issue.

Technical ContextAI

The affected devices are Brickcom-branded network IP cameras (CPE entries cover the cube, dome, bullet, and box form factors), which expose web and streaming management services for configuration and video retrieval. CWE-1392 (Use of Default Credentials) describes a class of weakness where the vendor ships hardcoded or well-known default usernames/passwords that are not forced to be changed on first use, allowing anyone with knowledge of the defaults - typically published in user manuals or device labels - to authenticate as if they were a legitimate administrator. In IP camera deployments these credentials typically protect ONVIF, RTSP, and HTTP management endpoints, so a successful default-credential login unlocks live video streams, recordings, and often device configuration.

RemediationAI

No vendor-released patch identified at time of analysis - the references include a CISA ICS advisory (ICSA-26-162-03) and vendor page but no fixed firmware version in the supplied data, so consult https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03 and the CSAF JSON at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-03.json for the latest vendor remediation guidance. Immediately change any factory default username/password on every Brickcom Cube, Dome, Bullet, and Box camera to a unique strong credential per device, and audit which accounts remain enabled (side effect: any integration relying on the default account - DVR, NVR, VMS - must be reconfigured with the new credentials). As compensating controls, place cameras on an isolated VLAN with no inbound internet exposure, block ports 80/443/554/8080 and the ONVIF discovery port at the network edge, and restrict management access to a jump host or VPN (trade-off: remote viewing apps and cloud integrations will break until reconfigured through the restricted path).