# Cognex In-Sight cameras: multiple credential and auth bypass flaws

Published: 2025-09-18 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/753f1f6f-ac9d-5145-b584-3628af88ddb7/cognex-in-sight-cameras-multiple-credential-and-auth-bypass-flaws

> Nine vulnerabilities in Cognex In-Sight vision systems allow adjacent attackers to steal credentials, bypass authentication, and modify device settings without patches available.

Cognex In-Sight Explorer and In-Sight Camera Firmware versions 5.x through 6.5.1 across all 2000/7000/8000/9000 series contain nine distinct vulnerabilities affecting industrial vision systems deployed in critical manufacturing worldwide. The flaws enable adjacent network attackers and local users to intercept cleartext credentials during firmware upgrades and device management, exploit hard-coded passwords, replay captured authentication tokens due to key reuse, and invoke privileged operations (network/serial settings changes) through insufficient permission checks on the Telnet management service (port 23) and proprietary protocol (port 1069). No public exploitation has been reported. Cognex classifies these products as legacy and recommends migration to next-generation In-Sight Vision Suite systems; defenders should isolate affected devices from internet and business networks, enforce network segmentation, and apply remote access controls pending vendor firmware updates.

## Mentioned in this report

- Vulnerabilities: CVE-2025-47698, CVE-2025-52873, CVE-2025-53947, CVE-2025-53969, CVE-2025-54497, CVE-2025-54754, CVE-2025-54810, CVE-2025-54818, CVE-2025-54860

## Detection guidance (public sample)

### Outbound Telnet Connection From Windows Host (Port 23)

ATT&CK: T1021.004

Windows host initiating a TCP connection to port 23, the cleartext Telnet management service exposed by legacy Cognex In-Sight cameras, where credentials can be sniffed or abused. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Telnet Connection From Windows Host (Port 23)
id: 944a59e0-e490-5fdc-a6b9-a561affead25
status: experimental
description: Detects a Windows host initiating a TCP connection to port 23 (Telnet).
  Legacy Cognex In-Sight cameras expose a cleartext Telnet management service with
  hard-coded credentials and weak permission checks. Telnet to an OT device from a
  workstation is a cleartext-credential and access risk. Tune by scoping to OT or
  industrial subnets.
tags:
- attack.lateral-movement
- attack.credential-access
- attack.t1021.004
- attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Protocol: tcp
    DestinationPort: 23
  condition: selection
falsepositives:
- Network administrators using a telnet client to manage legacy switches or routers
- Legacy asset inventory or monitoring tools probing port 23
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
```

### Non-Cognex Process Connecting to In-Sight Proprietary Protocol Port 1069

ATT&CK: T1078

Outbound TCP connections to port 1069 from processes other than the In-Sight tooling, which may indicate replay of captured authentication or privileged calls against Cognex cameras. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Cognex Process Connecting to In-Sight Proprietary Protocol Port 1069
id: 0c8abd91-bee5-5b02-bdaa-0cf1dd4e2590
status: experimental
description: Detects outbound TCP connections to port 1069, the proprietary Cognex
  In-Sight management protocol, from processes that are not the In-Sight software.
  The protocol has insufficient permission checks and key reuse that allow replayed
  authentication and privileged setting changes. Scope to hosts that should not manage
  cameras.
tags:
- attack.credential-access
- attack.stealth
- attack.defense-impairment
- attack.t1078
- attack.t1556
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Protocol: tcp
    DestinationPort: 1069
  filter_cognex:
    Image|contains: In-Sight
  condition: selection and not filter_cognex
falsepositives:
- Engineering workstations using renamed or custom Cognex tooling or SDK-based applications
- Unrelated applications that use port 1069 as an ephemeral or custom port
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/753f1f6f-ac9d-5145-b584-3628af88ddb7/cognex-in-sight-cameras-multiple-credential-and-auth-bypass-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup