HighCVSS 8.3
Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.
Vendor
brickcom vulnerabilities
4 published CVES affecting brickcom, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 0
- High
- 3
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- 100ap device firmware 2
- Box 2
- Bullet 2
- Cube 2
- Dome 2
- fb-100ap 2
- md-100ap 2
- ob-100ae 2
- osd-040e 2
- wcb-100ap 2
- wfb-100ap 2
Latest brickcom CVEs
Newest publication first
-
-
HighCVSS 8.3
Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.
-
HighCVSS 7.8
Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.0.6.16C1 and earlier, do not properly restrict access to configfile.dump, which allow remote attackers to obtain sensitive information (user names, passwords, a...
-
MediumCVSS 6.8 EPSS 12.4%
Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrator...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.