VORANT. Threat Intelligence Sign in Get the full feed

Kenik cameras hit by path traversal flaw

medium vulnerability manufacturing

An unauthenticated path traversal vulnerability in Kenik camera management panels allows attackers to read arbitrary server files.

CERT Polska coordinated disclosure of CVE-2026-7766, a path traversal vulnerability affecting Kenik camera management panel software. The flaw allows an unauthenticated attacker to send a crafted GET request containing an arbitrary file path, enabling them to read files stored on the affected device's server without any credentials.

The vendor has released fixes: KG-5260xxxx-IL-(G)2 camera models were patched in firmware version 2026-04-23, while the remainder of the affected product line received fixes in version 2025-04-21. The vulnerability was responsibly reported by Łukasz Bawolski of Exea Data Center through CERT Polska's coordinated vulnerability disclosure process. No evidence of active exploitation was noted in the advisory.

Mentioned in this report

Vulnerabilities CVE-2026-7766

Related reporting

Detection guidance

Kenik Camera Path Traversal Exploitation Attempt

ATT&CK T1190

Detects HTTP GET requests to Kenik camera management panel containing path traversal sequences (../ or ..\ encoded variants) targeting arbitrary file access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Kenik Camera Path Traversal Exploitation Attempt
description: Detects unauthenticated HTTP GET requests to Kenik camera management
  interface containing path traversal sequences (../, ..\ or URL-encoded equivalents
  %2e%2e) - CVE-2026-7766 exploitation attempts.
tags:
- attack.t1190
logsource:
  category: http_request
  product: network
detection:
  selection:
    http_method: GET
    destination_port:
    - 80
    - 443
    - 8080
    - 8443
    url|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
  condition: selection
falsepositives:
- Legitimate path traversal in non-Kenik web applications
- Security scanning tools deliberately testing path traversal
level: high
id: dabbd395-1926-55fb-af19-afb0081eedbe
status: experimental
author: Vorant

Unauthorized File Access from Kenik Camera Management Panel

ATT&CK T1190

Detects HTTP GET requests to Kenik camera endpoints returning file content (200 OK) without prior authentication, indicating successful path traversal exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized File Access from Kenik Camera Management Panel
description: Detects successful HTTP GET responses (200 OK) from Kenik camera management
  panel to unauthenticated clients requesting file paths via path traversal - CVE-2026-7766
  successful exploitation.
tags:
- attack.t1190
logsource:
  category: http_request
  product: network
detection:
  selection:
    http_method: GET
    http_status: 200
    destination_port:
    - 80
    - 443
    - 8080
    - 8443
    url|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
  filter_authenticated:
    http_headers|contains: Authorization|Cookie
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate content delivery through path parameters in non-vulnerable applications
- Development or test environments with intentional path-based routing
level: high
id: 7dda887a-cc48-56c8-9669-0310c4bd37f2
status: experimental
author: Vorant

Kenik Camera Management Panel Directory Enumeration

ATT&CK T1190

Detects multiple HTTP GET requests from a single source to Kenik camera management panel within a short timeframe, targeting different file paths via traversal - pattern consistent with automated exploitation scanning. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Kenik Camera Management Panel Directory Enumeration
description: Detects rapid sequential HTTP GET requests from a single source to Kenik
  camera management panel URLs containing path traversal sequences - consistent with
  automated exploitation or directory enumeration against CVE-2026-7766.
tags:
- attack.t1190
logsource:
  category: http_request
  product: network
detection:
  selection:
    http_method: GET
    destination_port:
    - 80
    - 443
    - 8080
    - 8443
    url|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
  filter_known_scanner:
    http_user_agent|contains:
    - Shodan|ZoomEye|masscan|Censys|nmap
  condition: selection and not filter_known_scanner
falsepositives:
- Security researchers performing authorized penetration testing
- Vulnerability scanning tools used by internal IT teams
level: medium
id: f734dd7f-a8fb-5c30-a170-b6e1ca2d45f6
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7766

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free