Kenik cameras path traversal enables file theft
Unauthenticated path traversal (CVE-2026-7766) in Kenik camera management panels allows arbitrary file reads; patches released.
CERT Polska coordinated disclosure of CVE-2026-7766, a path traversal vulnerability in Kenik camera management software. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with an arbitrary file path to read files from the server. The vulnerability affects Kenik KG-5260xxxx-IL-(G)2 cameras and other Kenik camera products.
Patches are available: version 2026-04-23 addresses the issue for KG-5260xxxx-IL-(G)2 models, while version 2025-04-21 fixes other affected products. The vulnerability was responsibly disclosed by Łukasz Bawolski of Exea Data Center.
Organizations using Kenik cameras should immediately verify firmware versions and apply available patches. The unauthenticated nature of this vulnerability makes it particularly accessible to opportunistic attackers and automated scanning.
Mentioned in this report
Detection guidance
Path Traversal Sequence in HTTP Request to Camera Management Interface
Detects HTTP GET requests containing directory traversal sequences (../ or URL-encoded variants) that may indicate exploitation of CVE-2026-7766 or similar unauthenticated path traversal vulnerabilities in Kenik camera web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequence in HTTP Request to Camera Management Interface
id: 4ee1166a-ab2b-5129-bc67-bc0a6ffb7d5d
status: experimental
description: Detects HTTP requests containing path traversal sequences (../, ..\,
or their URL-encoded equivalents) which may indicate exploitation of an unauthenticated
path traversal vulnerability such as CVE-2026-7766 in Kenik camera management software,
allowing arbitrary file read from the server.
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e%252f'
filter_common_scanners:
cs-uri-query|contains:
- /test/../test
condition: selection and not filter_common_scanners
falsepositives:
- Legitimate file management or update tools that use relative paths in URLs
- Vulnerability scanners performing authorized penetration testing
level: high
tags:
- attack.t1190
- attack.t1005
author: Vorant
HTTP Request for Sensitive System Files via Camera Web Interface
Detects HTTP GET requests to camera management web interfaces that reference well-known sensitive configuration or credential files, indicating potential exfiltration of local system files via a path traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request for Sensitive System Files via Camera Web Interface
id: 86cf2976-dce7-5ae9-b4ea-6a6883809c57
status: experimental
description: Detects HTTP requests to camera management interfaces (such as Kenik
KG-5260xxxx-IL-(G)2) that reference sensitive system or configuration files, consistent
with data theft following exploitation of an unauthenticated path traversal vulnerability
(CVE-2026-7766).
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- /etc/passwd
- /etc/shadow
- boa.cfg
- config.bin
- .htpasswd
- user.conf
- account.conf
condition: selection
falsepositives:
- Legitimate administrative access to configuration backup or export features
- Internal automated configuration audit tools
level: high
tags:
- attack.t1005
- attack.t1190
author: Vorant
Unauthenticated GET Request with File Path Parameter to Camera Device
Detects unauthenticated GET requests containing file or path query parameters commonly abused to trigger arbitrary file disclosure on vulnerable Kenik camera management endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated GET Request with File Path Parameter to Camera Device
id: e1b00cc5-9e57-59b2-bb1b-efda9f30f106
status: experimental
description: Detects GET requests to camera device web management interfaces that
include file or path parameters without prior authentication, which may indicate
attempts to exploit an unauthenticated path traversal vulnerability such as CVE-2026-7766
to read arbitrary files from the device filesystem.
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-query|contains:
- file=
- path=
- filename=
- download=
filter_authenticated:
cs-uri-query|contains:
- session=
- token=
condition: selection and not filter_authenticated
falsepositives:
- Legitimate firmware update or backup download features that use file parameters
after authentication
- Internal monitoring scripts retrieving device configuration exports
level: medium
tags:
- attack.t1190
- attack.t1005
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7766
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free