Vs Ipc1002 Firmware
Monthly
Denial of service in Vilar VS-IPC1002 IP cameras (confirmed on firmware 1.1.0.18) allows an unauthenticated attacker located on the same local network segment to render the device completely unresponsive by sending a single crafted request to the /cgi-bin/action CGI endpoint; recovery requires a manual power cycle or restart. No credentials or user interaction are needed, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the adjacent-network prerequisite and high availability impact, while the CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no confidentiality or integrity loss. Exploitation is bounded to the LAN and there is no public exploit code identified at time of analysis, no CISA KEV listing, and a low EPSS score of 0.23% (13th percentile); the vendor did not respond to CERT.PL, so no vendor-released patch is identified at time of analysis. This is a genuine but geographically-contained availability threat, not a widespread emergency.
Reflected cross-site scripting in the Vilar VS-IPC1002 IP camera firmware lets unauthenticated attackers run arbitrary JavaScript in the browser of a logged-in administrator, enabling session theft or unauthorized camera actions. Exploitation requires the admin to be induced to open a crafted GET request to the /cgi-bin/action endpoint (active user interaction) and typically needs adjacent-network positioning, since these cameras normally sit on LANs; no public exploit code has been identified and CISA KEV does not list this issue. The vendor never responded to CERT.pl, so no patch exists, EPSS is 0.22% (11th percentile), and only firmware 1.1.0.18 has been confirmed affected.
Denial of service in Vilar VS-IPC1002 IP cameras (confirmed on firmware 1.1.0.18) allows an unauthenticated attacker located on the same local network segment to render the device completely unresponsive by sending a single crafted request to the /cgi-bin/action CGI endpoint; recovery requires a manual power cycle or restart. No credentials or user interaction are needed, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the adjacent-network prerequisite and high availability impact, while the CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no confidentiality or integrity loss. Exploitation is bounded to the LAN and there is no public exploit code identified at time of analysis, no CISA KEV listing, and a low EPSS score of 0.23% (13th percentile); the vendor did not respond to CERT.PL, so no vendor-released patch is identified at time of analysis. This is a genuine but geographically-contained availability threat, not a widespread emergency.
Reflected cross-site scripting in the Vilar VS-IPC1002 IP camera firmware lets unauthenticated attackers run arbitrary JavaScript in the browser of a logged-in administrator, enabling session theft or unauthorized camera actions. Exploitation requires the admin to be induced to open a crafted GET request to the /cgi-bin/action endpoint (active user interaction) and typically needs adjacent-network positioning, since these cameras normally sit on LANs; no public exploit code has been identified and CISA KEV does not list this issue. The vendor never responded to CERT.pl, so no patch exists, EPSS is 0.22% (11th percentile), and only firmware 1.1.0.18 has been confirmed affected.