Cognex In-Sight cameras: multiple credential and auth bypass flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Nine vulnerabilities in Cognex In-Sight vision systems allow adjacent attackers to steal credentials, bypass authentication, and modify device settings without patches available.
Cognex In-Sight Explorer and In-Sight Camera Firmware versions 5.x through 6.5.1 across all 2000/7000/8000/9000 series contain nine distinct vulnerabilities affecting industrial vision systems deployed in critical manufacturing worldwide. The flaws enable adjacent network attackers and local users to intercept cleartext credentials during firmware upgrades and device management, exploit hard-coded passwords, replay captured authentication tokens due to key reuse, and invoke privileged operations (network/serial settings changes) through insufficient permission checks on the Telnet management service (port 23) and proprietary protocol (port 1069). No public exploitation has been reported. Cognex classifies these products as legacy and recommends migration to next-generation In-Sight Vision Suite systems; defenders should isolate affected devices from internet and business networks, enforce network segmentation, and apply remote access controls pending vendor firmware updates.
Mentioned in this report
Detection guidance
Outbound Telnet Connection From Windows Host (Port 23)
Windows host initiating a TCP connection to port 23, the cleartext Telnet management service exposed by legacy Cognex In-Sight cameras, where credentials can be sniffed or abused. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Telnet Connection From Windows Host (Port 23)
id: 944a59e0-e490-5fdc-a6b9-a561affead25
status: experimental
description: Detects a Windows host initiating a TCP connection to port 23 (Telnet).
Legacy Cognex In-Sight cameras expose a cleartext Telnet management service with
hard-coded credentials and weak permission checks. Telnet to an OT device from a
workstation is a cleartext-credential and access risk. Tune by scoping to OT or
industrial subnets.
tags:
- attack.lateral-movement
- attack.credential-access
- attack.t1021.004
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
Protocol: tcp
DestinationPort: 23
condition: selection
falsepositives:
- Network administrators using a telnet client to manage legacy switches or routers
- Legacy asset inventory or monitoring tools probing port 23
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
Non-Cognex Process Connecting to In-Sight Proprietary Protocol Port 1069
Outbound TCP connections to port 1069 from processes other than the In-Sight tooling, which may indicate replay of captured authentication or privileged calls against Cognex cameras. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Cognex Process Connecting to In-Sight Proprietary Protocol Port 1069
id: 0c8abd91-bee5-5b02-bdaa-0cf1dd4e2590
status: experimental
description: Detects outbound TCP connections to port 1069, the proprietary Cognex
In-Sight management protocol, from processes that are not the In-Sight software.
The protocol has insufficient permission checks and key reuse that allow replayed
authentication and privileged setting changes. Scope to hosts that should not manage
cameras.
tags:
- attack.credential-access
- attack.stealth
- attack.defense-impairment
- attack.t1078
- attack.t1556
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
Protocol: tcp
DestinationPort: 1069
filter_cognex:
Image|contains: In-Sight
condition: selection and not filter_cognex
falsepositives:
- Engineering workstations using renamed or custom Cognex tooling or SDK-based applications
- Unrelated applications that use port 1069 as an ephemeral or custom port
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs